Kerberoasting
This page deals with compromising Active Directory with Kerberoast attack.
Last updated
This page deals with compromising Active Directory with Kerberoast attack.
Last updated
Before going into this attack, you should have basic knowledge about what is SPN, Kerberos and how it grants the tickets to access a certain service. Here are two articles that can help with that :
So what's this attack all about :
An attacker scans Active Directory for user accounts with SPN values set using any number of methods, including PowerShell and LDAP queries, scripts provided by the Kerberoast toolkit, or tools like PowerSploit, Bloodhound .. (in our case we already have an account since we're in a post compromise phase)
Once a list of target accounts is obtained, the attacker requests service tickets from AD using SPN values
Once the tickets are saved to disk, the attacker passes them into a password cracking script that will run a dictionary of passwords as NTLM hashes against the service tickets they have extracted until it can successfully open the ticket. When the ticket is finally opened, it’ll be presented to the attacker in clear text.
The output should look something like this :
copy the tickets to a file and try to crack it with hashcat using the following command :
