What is a Kerberoasting attack?

What is a Kerberoasting attack?

Kerberoasting is one of the most common attacks against domain controllers. It is used to crack a Kerberos (encrypted password) hash using brute force techniques.

What is Kerberoasting detection?

Kerberoasting can be an effective method for extracting service account credentials from Active Directory as a regular user without sending any packets to the target system. This attack is effective since people tend to create poor passwords.

Who discovered Kerberoasting?

Kerberoasting is an attack that was discovered by Tim Medin in 2014, it allows a normal user in a Microsoft Windows Active Directory environment to be able to retrieve the hash for a service account in the same Active Directory environment.

Can Kerberos be cracked?

Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain. Microsoft’s Kerberos implementation in Active Directory has been targeted over the past couple of years by security researchers and attackers alike.

What is a pass the ticket attack?

In a pass-the-ticket attack, an attacker is able to extract a Kerberos Ticket Granting Ticket (TGT) from LSASS memory on a system and then use this on another system to request Kerberos service tickets (TGS) to gain access to network resources.

What hash does Kerberos use?

Prior to Windows Server 2008, the NT hash was used in what is called the pre-auth part of Kerberos, although AES is utilized in W2K8 and later OS versions. Notably, starting with Windows 7 and Windows Server 2008 R2, authentication protocols other than Kerberos can be turned off via a feature called Restrict NTLM.

What is NTLM hash?

LM- and NT-hashes are ways Windows stores passwords. NT is confusingly also known as NTLM. These use the NT-hash in the algorithm, which means it can be used to recover the password through Brute Force/Dictionary attacks. They can also be used in a relay attack, see byt3bl33d3r’s article [1].

What’s the difference between pass-the-hash and pass-the-ticket?

One primary difference between pass-the-hash and pass-the-ticket, is that Kerberos TGT tickets expire (10 hours by default) whereas NTLM hashes only change when the user changes their password. So a TGT ticket must be used within its lifetime, or it can be renewed for a longer period of time (7 days).

What are pass-the-hash and pass-the-ticket attacks?

A Pass-the-Hash (PtH) attack is a technique whereby an attacker captures a password hash (as opposed to the password characters) and then simply passes it through for authentication and potentially lateral access to other networked systems.

How does kerberoasting attack the authentication process?

Kerberoasting attacks the kerberos authentication process. When an AD user is configured with an SPN, they are a “service” account in the domain. This is done so that services on systems can run under the context of the service account, and to then allow for other AD users to authenticate to the service account using kerberos.

Why does kerberoasting only work against domain based SPNS?

Kerberoasting attacks work only against domain user SPNs. That is because host-based SPNs are secured with random 128-character passwords that are changed every 30 days. These long, random, and short lived passwords are practically unguessable, even with modern password cracking tools and hardware. User account SPN passwords are a different story.

How does a Kerberos attack work in Active Directory?

When the malicious user is authenticated, they receive a ticket granting ticket (TGT) from the Kerberos key distribution center (KDC) that is signed by its KRBTGT service account in Active Directory. Next, the malicious actor requests a service ticket for the service they wish to compromise.

Can a adversary kerberoast more than one service account?

Or, an adversary may Kerberoast as many accounts as possible. In either case, the adversary needs to enumerate the servicePrincipalNames for the service accounts they wish to Kerberoast. An adversary can use LDAP to query Active Directory for any user accounts with defined SPNs.