Kerberoasting
In this section, we will abuse a service ticket
and attempt to crack the password of the service account.
To perform this attack, we’ve again connected to CLIENT75 via RDP
as domain user jeff with his credentials.
To perform Kerberoasting, we’ll use Rubeus again.
We specify the kerberoast command to launch this attack technique.
In addition, we’ll provide hashes.kerberoast
as an argument for /outfile to store the resulting TGS- REP hash in.
Since we’ll execute Rubeus as an authenticated domain user,
the tool will identify all SPNs linked with a domain user.
The output shows that Rubeus identified one user account
vulnerable to Kerberoasting
and wrote the hash to an output file.
Now, let’s copy hashes.kerberoast to our Kali machine.
We pasted it into a text file named hashes.kerberoast
in the home directory of user kali.
We can then review the Hashcat help
for the correct mode to crack a TGS-REP hash.
The output of the second command shows that 13100
is the correct mode to crack TGS-REP hashes.
As in the previous section,
we’ll start Hashcat with the arguments 13100 as mode,
rockyou.txt as wordlist,
best64.rule as rule file,
and --force as we perform the cracking in a VM.
Great!
We successfully retrieved the plaintext password of the user
iis_service by performing Kerberoasting.
Next, let’s perform Kerberoasting from Linux.
We can use impacket-GetUserSPNs with the IP of the domain controller
as the argument for -dc- ip.
As before, we can use -request
to obtain the TGS and output them in a compatible format for Hashcat.
Since our Kali machine is not joined to the domain,
we also have to provide pete’s domain user credentials
to obtain the TGS-REP hash.
The output shows that we successfully obtained the TGS-REP hash.
Now, let’s copy the TGS-REP hash.
And we pasted it into a file named hashes.kerberoast2.
Now we’ll crack it with Hashcat as we did before.
The output shows that we could successfully crack the TGS-REP hash again,
providing the same plaintext password as before.
This technique is immensely powerful if the domain contains
high-privilege service accounts with weak passwords,
which is not uncommon in many organizations.
However, if managed or group-managed service accounts
are employed for the specific SPN,
the password will be randomly generated, complex,
and 120 characters long, making cracking infeasible.
We’ve now covered how an SPN can be abused to obtain
a TGS-REP hash and how to crack it.
In the next section,
we’ll explore an attack utilizing a forged TGS.