We had established at the intro of the skill that we were using our lab to be able to kind of bend the system and rules a little bit to help us understand how things happen between a client workstation and an actual domain controller.
And this works out perfectly in our demonstration up here for Kelly. Remember this? This is what I showed you when we started things off where I had gone through and recorded traffic between the client VM and the actual domain controller that is inside of this lab.
Now, the reason that I have this lab set up the way that we do is so that way you can record traffic on an independent interface such as Ethernet 1 and have all of the session monitoring stuff be set here so that way it's allowable for practice.
And when we're out in the wild, we may not have this all the time, so it's better for us to be able to see how something interacts based on action.
So, as we already mentioned, you see a bunch of requests going from client VM to server VM, the Active Directory domain controller.
Now, if you want to replicate this, you fire up the promiscuous mode on Ethernet 1 and just go and log into client workstation, the client VM, with a username and password. It could be the Eric account, it could be the administrator, it could be whoever you decide to create on that domain controller.
By doing all of this, we're opening up a passive form of attack called passive Kerberoasting.
Kerberoasting? Roasting the Kerberos.
And this is also going into that passive harvesting.
Now, passive harvesting itself, as a definition, is very broad in the pentesting sense because we're harvesting information passively.
So, it would just be like putting your glass up to the door and just listening, which is essentially what we're doing here, but we're focusing on the actual Kerberos of this.