Kerberoasting

0x00 Preface

Kerberoasting is a technique often used in domain penetration. This article will refer to public information and combine my own understanding to introduce the principle and implementation of Kerberoasting, as well as a method of backdoor utilization, and finally give defense suggestions.

Reference materials:

http://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/
http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
https://malicious.link/post/2016/kerberoast-pt1/
https://malicious.link/post/2016/kerberoast-pt2/
https://malicious.link/post/2016/kerberoast-pt3/
https://adsecurity.org/?p=3458
https://adsecurity.org/?page_id=183
https://blog.netspi.com/faster-domain-escalation-using-ldap/
https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx

0x01 introduction

This article will introduce the following:

  • Kerberoasting related concepts

  • Principle of Kerberoasting

  • Implementation of Kerberoasting

  • Kerberoasting's backdoor utilization

  • Kerberoasting defense

0x02 basic concepts

SPN

Official documents:

Full nameService Principal Names

The Service Principal Name (SPN) is a unique identifier for a service instance. Active Directory Domain Services and Windows provide support for Service Principal Names (SPNs), which are key components of the Kerberos mechanism through which a client authenticates a service.

There are two types of SPN, one is registered under the machine account (Computers) on the AD, and the other is registered under the domain user account (Users)

When the authority of a service is Local SystemOR Network Service, the SPN is registered under the machine account (Computers)

When the authority of a service is a domain user, the SPN is registered under the domain user account (Users)

SPN format

Description:

  • serviceclass can be understood as the name of the service, common ones include www, ldap, SMTP, DNS, HOST, etc.

  • There are two forms of host, FQDN and NetBIOS name, such as server01.test.com and server01

  • If the service is running on the default port, the port number (port) can be omitted

Query SPN

Initiating an LDAP query to the domain controller is part of the normal kerberos ticket behavior, so the operation of querying the SPN is difficult to detect

(1) Use SetSPN

Tools that come with Win7 and Windows Server2008

View all SPNs in the current domain:

View all SPNs in the test domain:

Examples of output results:

Each line starting with CN represents an account, and the information under it is the SPN associated with the account

For the output data above, the machine account (Computers) is:

  • CN=DC1,OU=Domain Controllers,DC=test,DC=com

  • CN=COMPUTER01,CN=Computers,DC=test,DC=com

Domain user accounts (Users) are:

  • CN=krbtgt,CN=Users,DC=test,DC=com

  • CN=MSSQL Service Admin,CN=Users,DC=test,DC=com

There are two SPNs registered under the domain user account (Users): kadmin/changepwandMSSQLSvc/DC1.test.com

0x03 Principle of Kerberoasting

“Kerberos is for authentication not for authorization, this lacuna allows kerberoasting”

1. Kerberos authentication process

A simple Kerberos authentication process is shown below

For 4.tgs_reply, the user will receive the TGS (service ticket) encrypted by the NTLM hash of the target service instance, the encryption algorithm isRC4-HMAC

From the perspective of utilization, after obtaining this TGS, we can try to exhaust passwords, simulate the encryption process, and generate TGS for comparison. If the TGS is the same, the representative password is correct, and the plaintext password of the target service instance can be obtained

2. The Windows system obtains the correspondence between services and service instance accounts through SPN query

Here is an example:

User a wants to access the resources of the MySQL service. When it reaches 4.tgs_reply, the steps are as follows:

(1)Domain Controller queries the SPN of MySQL service

If the SPN is registered under the machine account (Computers), the servicePrincipalName attribute of all machine accounts (Computers) will be queried to find the corresponding account

If the SPN is registered under a domain user account (Users), the servicePrincipalName attribute of all domain users (Users) will be queried to find the corresponding account

(2) After finding the corresponding account, use the NTLM hash of the account to generate TGS

3. All hosts in the domain can query SPN

4. Any user in the domain can request TGS from any service in the domain

In summary, any host in the domain can request TGS from all services in the domain by querying the SPN, and brute force it after obtaining the TGS

For the cracked plaintext password, only the password of the domain user account (Users) has value, regardless of the password of the machine account (cannot be used for remote connections)

Therefore, the efficient use of ideas is as follows:

  1. To query the SPN and find a valuable SPN, the following conditions must be met:

    • The SPN is registered under the domain user account (Users)

    • Domain user account has high permissions

  2. Request TGS

  3. Export TGS

  4. Brute force

0x04 Kerberoasting implementation method one

1. Get valuable SPN

The following conditions need to be met:

  • The SPN is registered under the domain user account (Users)

  • Domain user account has high permissions

You can choose from the following three methods:

(1) Use the powershell module Active Directory

Note: The powershell module Active Directory needs to be installed in advance, and domain controllers usually install it

For systems that have not installed the Active Directory module, you can import the Active Directory module through the following command:

(2) Use PowerView

(3) Use kerberoast

powershell:

https://github.com/nidem/kerberoast/blob/master/GetUserSPNs.ps1

vbs:

https://github.com/nidem/kerberoast/blob/master/GetUserSPNs.vbs

The parameters are as follows:

2. Request TGS

(1) Request to specify TGS

(2) Request all TGS

After execution, enter to klistview the ticket in the memory, you can find the obtained TGS

3. Export

Use mimikatz

4. Crack

0x05 Kerberoasting implementation method two

Automatic implementation, and does not require mimikatz, ordinary user permissions are sufficient, reference materials:

Code address:

Use System.IdentityModel.Tokens.KerberosRequestorSecurityTokenrequest TGS, extract TGS from the returned result, and choose John the Ripper or Hashcat to crack the output TGS

Kerberoasting Major Steps

This attack is multiple steps process as given below:

PreviousAbusing AdminSDHolder for PersistenceNextWhat is Kerberos and how it works (ar)

Last updated

Was this helpful?