{"id":38,"date":"2025-03-04T05:32:25","date_gmt":"2025-03-04T05:32:25","guid":{"rendered":"http:\/\/racrx.io\/?p=38"},"modified":"2025-03-15T00:31:28","modified_gmt":"2025-03-15T00:31:28","slug":"kerberoasting-what-is-it","status":"publish","type":"post","link":"https:\/\/racrx.io\/?p=38","title":{"rendered":"Kerberoasting &#8211; What is it?"},"content":{"rendered":"\n<p>Kerberoasting is a post-exploitation attack technique in which an attacker extracts service account credentials from the Kerberos authentication system in a Windows Active Directory (AD) environment. The attacker can then attempt to crack the extracted credentials offline to gain unauthorized access to privileged accounts.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Technical Breakdown of Kerberoasting:<\/strong><\/h3>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>1. Understanding Kerberos Authentication<\/strong><\/h4>\n\n\n\n<p>Kerberos is a network authentication protocol that relies on ticket-based authentication. It consists of:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Key Distribution Center (KDC) \u2013 A service running on the Domain Controller (DC) that issues tickets.<\/li>\n\n\n\n<li>Ticket Granting Ticket (TGT) \u2013 Issued to users after authentication, allowing them to request service tickets.<\/li>\n\n\n\n<li>Service Principal Name (SPN) \u2013 A unique identifier for a service associated with an Active Directory account.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>2. Attack Prerequisites<\/strong><\/h4>\n\n\n\n<p>For a successful Kerberoasting attack, the attacker needs:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A valid domain user account (even a low-privileged one).<\/li>\n\n\n\n<li>Access to request service tickets for services running under AD service accounts.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>3. Attack Execution Steps<\/strong><\/h4>\n\n\n\n<h5 class=\"wp-block-heading\"><strong>Step 1: Enumerate Service Accounts<\/strong><\/h5>\n\n\n\n<p>The attacker first identifies service accounts associated with SPNs by using tools like:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>setspn.exe -T domain -Q *\/*<\/code><\/li>\n\n\n\n<li>PowerShell scripts (e.g., <code>Get-SPN<\/code> in PowerView)<\/li>\n\n\n\n<li><code>Rubeus.exe<\/code><\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\"><strong>Step 2: Request a Service Ticket (TGS)<\/strong><\/h5>\n\n\n\n<p>Using the <code>kinit<\/code> command (on Linux) or PowerShell, the attacker requests a Ticket Granting Service (TGS) ticket for a service account.<\/p>\n\n\n\n<p>Example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>GetUserSPNs.py domain\/user:password -request<br><\/code><\/pre>\n\n\n\n<p>The TGS is encrypted using the NTLM hash of the service account&#8217;s password.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\"><strong>Step 3: Extract the Ticket from Memory<\/strong><\/h5>\n\n\n\n<p>Once the TGS is obtained, the attacker extracts the ticket from memory using:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mimikatz: <code>sekurlsa::tickets<\/code><\/li>\n\n\n\n<li>Rubeus: <code>Rubeus.exe dump \/format:kirbi<\/code><\/li>\n\n\n\n<li>PowerShell scripts to read <code>klist<\/code> output<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\"><strong>Step 4: Offline Brute-Force Cracking<\/strong><\/h5>\n\n\n\n<p>Since the TGS is encrypted with the NTLM hash of the service account, the attacker can perform an offline brute-force attack using tools like:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Hashcat: <code>hashcat -m 13100 extracted_hash wordlist.txt<\/code><\/li>\n\n\n\n<li>John the Ripper: <code>john --format=krb5tgs --wordlist=wordlist.txt extracted_hash<\/code><\/li>\n<\/ul>\n\n\n\n<p>If the password is weak, it can be cracked, granting the attacker access to the service account.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>4. Impact of Kerberoasting<\/strong><\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Privilege escalation if the cracked account has elevated permissions.<\/li>\n\n\n\n<li>Lateral movement within the network.<\/li>\n\n\n\n<li>Potential domain compromise if a highly privileged account is cracked.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>5. Mitigation Strategies<\/strong><\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use strong passwords for service accounts (long and complex).<\/li>\n\n\n\n<li>Rotate service account passwords regularly.<\/li>\n\n\n\n<li>Enforce Managed Service Accounts (MSAs) or Group Managed Service Accounts (gMSAs).<\/li>\n\n\n\n<li>Implement monitoring and alerting for anomalous Kerberos ticket requests.<\/li>\n\n\n\n<li>Disable RC4 encryption in Kerberos to make brute-force cracking harder.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Kerberoasting is a post-exploitation attack technique in which an attacker extracts service account credentials from the Kerberos authentication system in a Windows Active Directory (AD)&hellip; <a href=\"https:\/\/racrx.io\/?p=38\" class=\"apace-readmore-link\"><span class=\"screen-reader-text\">Kerberoasting &#8211; What is it?<\/span>Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-38","post","type-post","status-publish","format-standard","hentry","category-pentesting","category-red-team"],"_links":{"self":[{"href":"https:\/\/racrx.io\/index.php?rest_route=\/wp\/v2\/posts\/38","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/racrx.io\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/racrx.io\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/racrx.io\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/racrx.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=38"}],"version-history":[{"count":5,"href":"https:\/\/racrx.io\/index.php?rest_route=\/wp\/v2\/posts\/38\/revisions"}],"predecessor-version":[{"id":128,"href":"https:\/\/racrx.io\/index.php?rest_route=\/wp\/v2\/posts\/38\/revisions\/128"}],"wp:attachment":[{"href":"https:\/\/racrx.io\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=38"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/racrx.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=38"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/racrx.io\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=38"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}