Roasting

Kerberoasting

In Active Directory, Service Tickets can be requested by any authenticated domain user for any domain account tied to a service using a Service Principal Name (SPN).

Service Tickets are partially encrypted with the Kerberos key (derived from the account password) of the account tied to the service. Thus, you can try to crack the service account password by trying to decrypt the ST.

The hashcat mode for the default RC4 encrypted TGS-REP ticket is 13100

impacket-getUserSPNs

GitHub - fortra/impacket: Impacket is a collection of Python classes for working with network protocols.GitHub

Linux (Attacker)

getUserSPNs.py [domain/username]<:password> <options>

OPTIONS
-hashes [LMHASH:NTHASH]            NTLM Hashes, Format is LMHASH:NTHASH
-dc-ip [IP]                        IP Address Of The Domain Controller
-outputfile [file]                 Output Filename
-request                           Requests TGS For Users
-format                            Hashcat | John

Rubeus

ASREP-Roasting

In Kerberos Authentication, users typically need to perform Kerberos Pre-Authentication by sending a timestamp encrypted with the user's Kerberos key (derived from the account password) to the KDC.

If Kerberos Pre-Authentication is disabled for an account by setting the DONT_REQUIRE_PREAUTH flag, an attacker can impersonate the account by requesting a TGT from the KDC as the account. The KDC's AS-REP response will include a session key encrypted with the account's Kerberos key. This session key can then be cracked to obtain the account's password.

The hashcat mode for the AS-REP ticket is 18200

impacket-getNPUsers

GitHub - fortra/impacket: Impacket is a collection of Python classes for working with network protocols.GitHub

Linux

GetNPUsers.py [domain/username]<:password> <options>

OPTIONS
-hashes [LMHASH:NTHASH]            NTLM Hashes, Format is LMHASH:NTHASH
-dc-ip [ip]                        IP Address Of The Domain Controller
-outputfile [file]                 Output Filename
-request                           Requests AS-REP For Users
-format                            Hashcat | John

Rubeus