KERBEROS

PRIMARY CATEGORY → WINDOWS MOVEMENT

Components ⟡

• 
  • OVERPASS THE HASH
• 
  • PASS THE KEY - PtK
• 
  • PASS THE TICKET - PtT
• 
  • PASS THE CACHE
• 
  • PASS THE CERT - PtC
• 
  • ASREPROAST
• 
  • KERBEROAST
• 
  • DELEGATIONS
• 
  • SHADOW CREDENTIALS
• 
  • UNPAC THE HASH
• 
  • FORGED TICKETS
• 
  • KRB RELAY
• 
  • SAMACCOUNTNAME SPOOFING

---

Workflow

---

Date Sync with a DC

NTPDate

NTPDate

ntpdate '<DC>'
ntpdate -u '<DC>' # Random Source Port to bypass Firewall Restrictions

RDate

RDate

rdate -n '<DC>'

Date

If date sync with the DC does not work using the tools above, get the Server Time of the DC and set the system date manually as follows

It can be extracted from a NMAP Scan or from a DC’s Kerberos Response Packet (STime Field)

date -s '<DATE>'