CCNA Kerberos Attacks Questions

Requesting service tickets for accounts with registered SPNs yields TGS material encrypted with the service account's key, enabling offline cracking without lockout risk. The captured TGS-REQ traffic for MSSQLSvc SPNs confirms kerberoastable targets. Tools like Rubeus automate extraction and output hashcat-compatible hashes, letting the tester verify weak service account passwords safely.

Kerberoasting is characterized by the bulk request of service tickets and the subsequent offline cracking of the service account's password. Detectors look for anomalous TGS-REQ volume and specific encryption types (like RC4-HMAC) in the requests. Identifying these patterns allows security analysts to pinpoint service accounts that are currently under attack, enabling timely password resets or the implementation of Group Managed Service Accounts (gMSAs) to mitigate future risk.

The PAC is a data structure embedded within Kerberos tickets that contains user identity and group membership information. Because the PAC is signed by the KDC, it is normally trusted. However, if an attacker can forge a ticket, they can also manipulate the PAC within that ticket to elevate their privileges, such as adding themselves to the 'Domain Admins' group, bypassing normal authorization checks completely.

Kerberoasting requires identifying domain accounts that have a servicePrincipalName set, because those accounts can have a service ticket requested and cracked offline. The cleanest way to find them is a read-only LDAP search filtering on servicePrincipalName. This technique uses only legitimate authenticated access, avoids lockout risk, and does not alter the directory, making it the appropriate reconnaissance step.

Injecting a stolen TGT into the current session allows the system to request service tickets as the compromised user, enabling access to resources like file shares without the password. Pass-the-ticket leverages the TGT's validity until expiration, making it a powerful lateral movement technique.

Abusing unconstrained delegation requires forcing a high-value account, such as a domain controller, to authenticate to the delegation-enabled host so its TGT is cached, then extracting and reusing that TGT. Coercion techniques place the DC's TGT on APP01, and extraction tools enable impersonation, leading to domain compromise.

The success of cracking Kerberoasted tickets hinges on the encryption type and the service account's password strength. RC4 tickets are faster to crack than AES, and weak passwords are vulnerable to dictionary attacks. Other factors like number of tickets, domain functional level, or DC location do not affect the cryptographic difficulty of cracking.

Kerberoasting requires requesting a Service Ticket (TGS) from the Key Distribution Center (KDC) for a specific Service Principal Name (SPN). The attacker then extracts the encrypted TGS blob from memory or network traffic to crack the service account's password offline. The NTLM hash is a separate credential format; having it allows for Pass-the-Hash or silver ticket creation, but does not involve the KDC-based SPN request process required for Kerberoasting.

Kerberos Armoring, or Flexible Authentication Secure Tunneling (FAST), protects the exchange between the client and the KDC by creating a secure, encrypted tunnel using a separate key. This protects the AS-REQ and AS-REP packets from interception and tampering, effectively neutralizing attacks that rely on sniffing or modifying the initial authentication traffic.

Pass-the-Ticket is the technique that extracts and reuses a Kerberos ticket from a compromised host. When a domain administrator has an active session, their TGT resides in LSASS and can be exported and injected into another session. This grants the operator the administrator's access without needing the password or hash, perfectly matching the scenario's constraints.

In unconstrained delegation, a service account can take a user's TGT (which is sent to the service during authentication) and store it in its own memory. An attacker who compromises such a service can extract these stored TGTs. Because the TGT is valid for the whole domain, the attacker can then impersonate those users to any service in the domain, leading to total environment compromise.

AS-REP Roasting targets accounts that have Kerberos preauthentication disabled. The Impacket script GetNPUsers.py with the -request flag queries the domain for such accounts and requests an AS-REP for each, which can then be cracked offline. The other tools serve different purposes: GetUserSPNs.py is for Kerberoasting, secretsdump.py extracts secrets from hosts, and ticketer.py forges tickets.

Unconstrained delegation caches TGTs of authenticating users, so a domain administrator's logon on such a host exposes their TGT for impersonation. Constrained delegation with protocol transition and a sensitive target allows an attacker controlling the delegating account to impersonate any user, including administrators, to that service. Both configurations directly enable the described escalation and should be flagged.

gMSAs are designed to mitigate the risks associated with long-term static service account passwords. They feature automatically managed, complex passwords that are rotated frequently by the Active Directory domain controller. Because the passwords are long and changed regularly, they are effectively impossible to crack offline even if an attacker successfully captures the encrypted TGS ticket during a Kerberoasting attempt, rendering the attack functionally useless.

The DONT_REQ_PREAUTH flag allows an unauthenticated attacker to request an AS-REP for the account and receive data encrypted with the user's key. Capturing that response enables offline password cracking without any domain credentials, directly exploiting the disabled pre-authentication setting.

AS-REP Roasting targets user accounts that have 'Do not require Kerberos preauthentication' enabled. An attacker can request a TGT for such an account without providing a password. The KDC responds with an encrypted ticket (the AS-REP) that the attacker can then extract and crack offline, similar to how Kerberoasting works, to obtain the user's plaintext password.

Constrained delegation allows a service to impersonate a user to a specific set of other services, defined in the 'msDS-AllowedToDelegateTo' attribute. If an attacker compromises a service account configured for constrained delegation, they can request a service ticket for any user to the allowed target services. This allows the attacker to pivot throughout the network while impersonating high-privilege users without needing their credentials.