Kerberoasting
Depending on your position in a network, this attack can be performed in multiple ways:
From a non-domain joined Linux host using valid domain user credentials.
From a domain-joined Linux host as root after retrieving the keytab file.
From a domain-joined Windows host authenticated as a domain user.
From a domain-joined Windows host with a shell in the context of a domain account.
As SYSTEM on a domain-joined Windows host.
From a non-domain joined Windows host using runas /netonly.
Several tools can be utilized to perform the attack:
Impacket’s GetUserSPNs.py from a non-domain joined Linux host.
A combination of the built-in setspn.exe Windows binary, PowerShell, and Mimikatz.
From Windows, utilizing tools such as PowerView, Rubeus, and other PowerShell scripts.
A prerequisite to performing Kerberoasting attacks is either domain user credentials (cleartext or just an NTLM hash if using Impacket), a shell in the context of a domain user, or account such as SYSTEM. Once we have this level of access, we can start. We must also know which host in the domain is a Domain Controller so we can query it.
Linux
Listing SPN Accounts with GetUserSPNs.py
Requesting all TGS Tickets
Requesting a Single TGS ticket
Saving the TGS Ticket to an Output File
Here we've written the TGS ticket for the sqldev user to a file named sqldev_tgs. Now we can attempt to crack the ticket offline using Hashcat hash mode 13100.
Cracking the Ticket Offline with Hashcat
Testing Authentication against a Domain Controller
Windows
Semi Manual Method
Enumerating SPNs with setspn.exe and focus on the user accounts
Target a single user
Retrieve all tickets using setspn.exe
Extract tickets from memory using mimikatz.exe
Prepare the base64 blob for cracking and save the output file as .kirbi
Extract the Kerberos Ticket using kirbi2john.py
Modify the crack file for hashcat
Crack the hash with hashcat
Automated Method 1
Use PowerView to extract TGS Tickets
Use PowerView to target a specific user
Export all tickets to a csv file
Automated Method 2
Use rubeus with /stats flag
Using rubeus
Kerberoasting Notes
Kerberoasting tools typically request RC4 encryption when performing the attack and initiating TGS-REQ requests. This is because RC4 is weaker and easier to crack offline using tools such as Hashcat than other encryption algorithms such as AES-128 and AES-256.
When performing Kerberoasting in most environments, we will retrieve hashes that begin with $krb5tgs$23$*, an RC4 (type 23) encrypted ticket. Sometimes we will receive an AES-256 (type 18) encrypted hash or hash that begins with $krb5tgs$18$*.
While it is possible to crack AES-128 (type 17) and AES-256 (type 18) TGS tickets using Hashcat, it will typically be significantly more time consuming than cracking an RC4 (type 23) encrypted ticket, but still possible especially if a weak password is chosen.
We can use the /tgtdeleg flag on rubeus when requesting a new service ticket, The tool does this by specifying RC4 encryption as the only algorithm we support in the body of the TGS request.
Note: This does not work against a Windows Server 2019 Domain Controller, regardless of the domain functional level. It will always return a service ticket encrypted with the highest level of encryption supported by the target account.
Last updated