Now, taking a look at the traffic going back and forth between the client and the domain controller, you have Kerberos message type ==11, which I'm going to put the code for this below this video.
It's a Wireshark searching string that you can use to find packets that correlate with Kerberos, and specifically the AS-REP packet that is used in the authentication process of Kerberos.
Now, what are we specifically talking about here? I'm glad you asked. We're actually talking about the authentication service response, and this is actually part one. It ties into the following process of the TGS response that we get, but this is where we get the login success.
And then after this portion is complete, we are issued a master pass, so to speak, which is done through the TGS process, which we'll talk about in the next portion of this skill.
The reason I have all this up on the screen right now is because when you capture that packet information across the wire going from that client workstation to the domain controller and vice versa, you get a lot of information going back and forth, and you can see the entirety of the Kerberos authentication process happening before your very eyes.
Now, there is a little bit of a catch to this in that Kerberoasting is not as easy as it used to be back in the day, because as I mentioned later in this skill, that encryption algorithms have strongly increased over time, and that older methods like RC4 are thrown out in favor of AES-256.
Now, is that the actual password encryption? No. We're talking about password hashes that are encrypted with AES-256, so it's an encryption wrapper on top of the hash itself.
Now, the line I have highlighted, it says E-type. This is where it says AES-256. Now, on the right side where you see that the 12 is highlighted on that first line on the right, all that hex on the right right there, that's all of the actual cipher for the hash. Don't believe me? I'm now selecting the hash itself, and it goes even longer.
All of this right here is the actual basic payload that you're looking for in order to be able to decipher a discernible password to tie in with a credential based on what's happening on this chain of events right here.
Remember, this is just part one. We're just looking at the actual user or workstation itself with the user's credentials to be able to go in and log in to Active Directory and say, yep, you can come in, but what you do after that is based on the actual TVS response coming up in the next portion of the skill.