Learn Active Directory Kerberoasting
Source: YouTube · John Hammond · published Sep 4, 2023 · 22:06
This video demonstrates the Kerberoasting attack technique in Active Directory, showing how to identify Service Principal Names (SPNs), extract encrypted Kerberos service tickets, and crack them offline to access service accounts 0:06 2:23.
Key Takeaways:
• A test lab environment is established using a Domain Controller and Kali Linux, utilizing JSON schemas and PowerShell scripts to dynamically create users and assign SPNs for experimentation 0:00 12:48.
• The attack exploits the Kerberos protocol by requesting Ticket Granting Service (TGS) tickets for accounts associated with SPNs, resulting in encrypted ticket fragments that can be brute-forced 3:30 5:05.
• Tools like GetUserSPNs.py from the Impacket suite are used to enumerate SPNs and retrieve the ticket hashes, which are then cracked offline using John the Ripper to reveal the service account password 7:09 20:44.
By successfully cracking these hashes, an attacker can gain the credentials for service accounts, potentially allowing lateral movement and privilege escalation within the network.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
we've set up an active directory environment to be able to experiment and practice with local on-premise active directory attacks in this video I want to show you one technique that is very well known and super common and it should absolutely be in Your Arsenal because it's used on practically every internal penetration test let's dive into kerberosting now I know it's been a long time for active directory videos so just to bring us back to where we were let's review our virtual machine setup this is super simple this is about as simple as we can get for an active directory environment we have our domain controller virtual machine which is right here and I do remember the password for that thank you for everyone on Twitter and we have our management client which is outside of the domain bu…