Let's pull off this Kerber roasting attack.
So we're going to use get user SPF ends so get user SBN.
You should be able to auto tab complete that.
And now again all we need is that username and password from a domain account.
So marvel that local we're going to say f castle here and password one we need to know the Domain Controller
IP.
We're going to specify that with DC dash IP like this and we're gonna say 1 9 2 1 6 8 57 140 or whatever
your IP address is and do a dash request.
There you go.
So already very quick is how this happens.
It just comes down and it provides us the hash here.
So we requested that T.J. yes again.
And we can take a look at this and you can see that what came down was a sequel service.
Remember we did set that up and here it's going to give us this gave me our five T.S. hash.
So go ahead and copy this and what we're going to do is we're gonna put this I want to put this into
my hashes for same one I've been using and say that
so we could do a quick hash cap to find the module to do dash help and we can do a graphic on curved
arrows like this and we are after Kerber five ticket granting service to GSO 13.
One hundred here.
So what we'll do is we'll come into here and we'll just say similar to before Ash Kat 60 for EMC module
of 13 one hundred hashes for text and then we'll do a rock you that text.
Go ahead and hit enter after putting a capital O to optimize.
And this should just take a second here as well.
So we're going to let this run and then I'm going to give you a little spiel on this password.
So this password is going to crack and it's going to crack as my password 1 2 3 4 or 1 2 3 pound right.
And this is a 1 2 6 10 14 character password.
So remember how I said that even though 14 character is like the minimum I recommend these passwords
that use common word edge and just looks like this.
It's it's not safe.
This is a 14 character password and it felt so easily it's in rocket attacks Rocky was the base cracked
list.
Right.
A good crack list can still crack a 14 character password.
And like I said I've cracked a 19 character password before because it was a Bible verse.
So if it's something well-known or easily gets a little like this and uses dictionary words chances
are it's going to fall.
So I just wanted to harp on that.
But the bigger point is we have found the sequel service password.
This is the sequel service domain password here and we already knew what it was because we discovered
it earlier.
But this is a domain am an account because it was set up incorrectly your service account should not
be domain admin accounts but that happens all the time.
So we look for these accounts with Kirby roasting.
We try to crack these passwords and then we utilize these to access the domain controller access new
areas even lateral movement.
But this is a lot of the times considered vertical movement because it gets us right into a domain controller
when these have incorrect permissions set up.
So that's it.
This is one of the most common attacks that you will see in a network.
Once you get a credential at all you can try Kerber roasting and see if you can't get to password to
crack and leverage that.
So let's go ahead and talk about mitigations before we move on to some other attacks.