# Kerberos

### How Kerberos Works

{% embed url="<https://www.hackingarticles.in/deep-dive-into-kerberoasting-attack/>" %}

### AS-REP Roasting

{% embed url="<https://jsecurity101.medium.com/ioc-differences-between-kerberoasting-and-as-rep-roasting-4ae179cdf9ec>" %}

{% embed url="<https://blog.netwrix.com/2022/11/03/cracking_ad_password_with_as_rep_roasting/>" %}
Good recon
{% endembed %}

{% embed url="<https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/>" %}
Explaination&#x20;
{% endembed %}

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FUZpfz2Xyb6khVDCahKnK%2Fimage.png?alt=media&#x26;token=492315fa-7d32-4504-8338-d02e8e05a6e8" alt=""><figcaption></figcaption></figure>

### Kerberoasting

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2Fu1jDIy9wZP9Qrf92cy6q%2Fimage.png?alt=media&#x26;token=9b21051f-04f7-442b-a809-688bb0ad4bd9" alt=""><figcaption></figcaption></figure>

### RBAC

{% embed url="<https://swolfsec.github.io/2023-11-29-Detecting-Resource-Based-Constrained-Delegation/>" %}

### Services of Interest:

| Possible operation                                    | Service(s)                                                                                                                        | Description                                                                                                                                                  | Related note                                                                            |
| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- |
| <p><code>PsExec</code>-like<br>file system access</p> | `CIFS`                                                                                                                            | Remote execution of commands using `PsExec`-like utilities or full access to the machine file system.                                                        | <p><code>Windows - Lateral movements</code><br><code>\[L7] 445 - SMB</code></p>         |
| `WMI`                                                 | <p><code>HOST</code><br><code>RPCSS</code></p>                                                                                    | Remote execution of commands through `Windows Management Instrumentation (WMI)` (`Win32_Process` class for example).                                         | `Windows - Lateral movements`                                                           |
| `WinRM`                                               | <p>Always necessary:<br><code>HOST</code><br><code>HTTP</code><br>Host dependant:<br><code>WSMAN</code><br><code>RPCSS</code></p> | `PowerShell remoting` through `Windows Remote Management (WinRM)`.                                                                                           | <p><code>Windows - Lateral movements</code><br><code>\[L7] 5985-5968 - WSMan</code></p> |
| Windows services                                      | `HOST`                                                                                                                            | Remote creation and/or execution of Windows services.                                                                                                        | `Windows - Lateral movements`                                                           |
| Scheduled tasks                                       | `HOST`                                                                                                                            | Remote creation and/or execution of Windows scheduled tasks.                                                                                                 | `Windows - Lateral movements`                                                           |
| <p><code>DCSync</code><br>LDAP access</p>             | `LDAP`                                                                                                                            | `LDAP` requests, and notably allows, for `service tickets` to the `LDAP` service of a `Domain Controller`, the conduct of replication operations (`DCSync`). | `[ActiveDirectory] ntds.dit dumping`                                                    |
| `RSAT`                                                | <p><code>CIFS</code><br><code>LDAP</code><br><code>RPCSS</code></p>                                                               | Use of the PowerShell cmdlets of the Windows `Remote Server Administration Tools (RSAT)` suite.                                                              | `[ActiveDirectory] Domain Recon`                                                        |

{% embed url="<https://notes.qazeer.io/active-directory/exploitation-kerberos_silver_tickets>" %}

{% embed url="<https://notes.qazeer.io/active-directory/post_exploitation-kerberos_golden_tickets>" %}

### Mitigation:

{% embed url="<https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-reset-the-krbtgt-password>" %}

TGTs are encrypted with the KRBTGT hash. Resetting it will invalidate all TGTs within the domain.&#x20;

Note that the password history value for the KRBTGT account is 2, which means it includes the two most recent passwords. Therefore, to invalidate all TGTs currently in the system, you need to reset the password twice

**Important:** Be aware that changing the KRBTGT password will affect almost all subsequent Kerberos operations. In particular, all the TGTs that have been issued will be invalid since they were encrypted with the old password. However, all authenticated sessions that have been established to a resource (such as a file share, SharePoint site or Exchange server) are good until the service ticket is required to re-authenticate. Microsoft advises that rebooting a computer is the only reliable way to recover functionality, since this will force both the computer account and the user account to log back in again, which in turn ensures that they get new TGTs encrypted with the new KRBTGT password hash.

{% embed url="<https://blog.quest.com/golden-ticket-attacks-how-they-work-and-how-to-defend-against-them/>" %}

{% embed url="<https://blog.netwrix.com/what-is-kerberos/>" %}

{% embed url="<https://adsecurity.org/?p=1515>" %}

#### Considerations:

* NTDS contains old and current passwords in it.
* E:\Windows\NTDS can be a mounted virtual share from vsphere vmdk file.\\
