Focusing on the TGS REP or the actual Ticket Granting Service Response.
So a lot of acronyms here and I'm still trying to make sure I don't get tongue twisted on a lot of
them. So this is actually part two of our actual career roasting process and understanding what's
actually going on inside of the communication between a domain controller and an actual client.
Now the TGS reply or response is the actual yes yes from the actual domain controller
when you ask it for a specific resource or like something specific on the domain itself,
not necessarily just logging in per se. Let's say you're trying to access a file on file share or
somewhere like that. It's part two in the actual process of Kerberos itself with the AS
request and response previously being part one which is why we did that previously.
Now this is where you basically show your master pass after you've been given the authorization to
come inside. So you've been given you got through the username password now do you have the
uh ability or the authorization to do or see things and whenever you're looking for this
inside of the actual packet capture you can do this by the Kerberos message type of 13.
Now there's a couple things I want to point out here as I'm changing this inside of the actual
wire shark here of our of this example that I have pulled up and you could also pull this up
in the Active Directory example that we have already but as you see here as type 13 comes up
that we have many of packets in here that are going back and forth basically responding to
a request of some type in order to activate some sort of resource and the one I wanted to point
out is that as you dive into this you go into the actual Kerberos and I'll zoom in for you here
you go into Kerberos itself go down to TGS reply or response expand that go into ticket
expand that and then in ENC which is short for encryption dash part expand that and you'll
actually get to the bulk of the ticket itself to where you can actually start looking at the
hashes and whatnot. Now normally normally in older times this is where you would actually be doing
the Kerberoasting at in order to be able to crack the hash and I'm going to explain to you that you
can still do it here it just takes forever and a day and that's because the highlighted blue line
that I have called cipher is the actual bulk of the actual hash itself but it's in raw format so
you don't have the actual at the dollar signs at the beginning indicating what type of hash this is
well you have that two lines up in that you have E-type AES-256 CTF blah blah blah blah blah
long story short it's AES-256 and this is the modern day and age of a hashing algorithm or
encryption algorithm for that hash so that way it's harder to break. Now in the older days it
was RC4 and that's become very easy to break into and use hashcat to do this but you would take
this bulk right here and use the Kerberoasting directory to convert all this and if you're
interested in that I have the how to install it below just in case that your Kali box doesn't
have it already installed and we may touch on that later I just wanted to go through the packets real
quick but this is where the bulk of that master pass is at and then you have to have the passive
ability to be able to hear the client user communicating with that domain controller to
be able to get these packets going back and forth. Now because this one is E-type 18 which is AES-256
it becomes unreasonable to try to use programs like hashcat to break this one open.
I just wanted to show you what the inside of the actual TGS response packet looks like and so that
way you can actually start searching for them yourselves as I have the syntax for Wireshark
searching right below this video.