Now there's a couple of different attacks that we can use on user accounts on Active Directory.
Now I went ahead and went through the whole Wireshark and breaking down and I still want
to continue to do that but I'm going to show you some tools to make this a whole lot easier.
So bear with me here. So inside of our lab we are taking a look at the actual Wireshark
of the AS response packets. Now I know that the one that I'm looking at here is Zafod's packet
when he tried to log in into the Active Directory domain. I know this because I can break this down
and get all the information out of the packet itself which will lead us into doing this the
easier way as well. So by taking a look at this packet and again this is in the traffic example
that we have on the actual desktop itself. I want to show you that inside of this package header
that let me zoom in for you here real quick you can see here that I have packet 1886 highlighted.
Now inside of the actual Kerberos portion of the packet itself you'll see that I have expanded AS
rep gone down to CNAME expanded down under CNAME string you see one item that CNAME string is
Zafod and that tells you the actual username that we're dealing with here. So is that part
encrypted? Absolutely not and it's never going to be. And if you look up a little bit under PA data
and the C Realm this is two lines below where it's highlighted for type 19. You see the actual
C Realm of texas.test. So we actually get the domain the actual username and we even go through
and get the encryption type because up above you see message type krb as rep 11. Now that's the
letting you know that this is Kerberos AS rep but that ties into as I zoom zoom out so I can zoom
down for you down here at the bottom now as I highlight that and then zoom in for you here
that a e-type as 256 and all the way on the right is that 18 there and that's going to be key here
in just a moment. That ties directly into that Kerberos AS rep response that we get from the
actual Active Directory domain letting us know domain username type payload because cipher down
the last line of cipher that's the actual password and you have to do a lot of finagling in order to
be able to take all this raw data compile it together and to be able to run it through programs
like Hashcat or John the Ripper. Now I'm going to show you a whole lot easier way to do this.
I wanted to show you how this is broken down inside of Wireshark before we actually start
doing a little bit of roasting on AS rep. All commands will be in the code box below and what
we're taking a look at here is the mpacket subcommand and there's a lot of different
commands with that so mpacket dash and this one is sudo mpacket dash get np users. Now I'm also
identifying that I'm doing this with no password by the dash no pass in fact I'll zoom in for you
here real quick and the users file I'm referring to a list of usernames that I have on the desktop
called users which is in that users block right there and there's two users in there Eric and
Zaphod just the usernames that's it we've done this enumeration in previous skills so we should
already have these usernames or you can enumerate them and build your own list from the actual
Wireshark packet capture that we already went through because we've seen that you can actually
pull names from these AS rep packets. Now we know the DCIP is 0.49 and the dash TS is going to be
the actual domain of texas.test and what this does is it analyzes and uses the ability of
AS rep response in order to get back what we just saw inside of the packet itself and when this is
ran you can see that we have a actual hashcat output type of Zaphod's user account. Now why
not Eric's user account? Well I'm glad you asked and I already put a hint to this inside of the
actual skill itself. Inside of Active Directory you may notice that I have Zaphod pulled up here
in Active Directory users and computers and inside of his account if I scroll all the way down and
then zoom in for us here you can see that we do not require Kerberos pre-authentication.
Basically I'm cutting out a step here and this can be done for a few reasons but primarily the
only reason that I've ever seen this box checked is because there's a system on the network that
is not compatible truly with the actual domain controller operating system version. I have seen
in some cases it may be network related but those are far and few in between and that kind of
satellite technology DOD side is getting a whole lot better so latency is not that big of an issue
anymore. But when you do not require Kerberos pre-authentication you're basically cutting the
Kerberos authentication process in half and because of that that opens up ASREP and to things like
roasting. Now whenever you run this open up the actual Kali box itself and go in and take all
that data you got for the M packet when you were doing the user retrieval for that hashcat string
and run it against John the Ripper. Now full disclosure here I made the password word list
for John the Ripper extremely short to the point where it's only one line. It's that P at dollar
dollar W capital W O R D and the reason I did that is to save you some time and just get you
the experience of actually running this. If you run this with the actual full-on word list of
John the Ripper then this will take quite some time far exceeding the actual length that you
would actually use inside the whole course overall. Because we're going to say John use
the word list of short.txt inside of user share word list which is there for you already and then
the format is going to be KRB 5 ASREP using a file on the desktop called Zaphot. Now you may
be wondering where did I get this file? All I did was go into the actual terminal
and take this string that I got from using the M packet command copy that right there and just
save it to a file called Zaphot on the desktop and that's what I'm using inside of John. Now once you
run John it will take a look at this what is considered one line right here but this code
this hash output and run it through its word list compared to the algorithm that you told it
to run it as. In this instance KRB 5 ASREP and because you were able to retrieve this ASREP
string from the actual domain controller through roasting because pre-authentication has been
turned off for that one particular account but it wasn't for Eric by the way you were able to go
through and use John the Ripper to be able to get that password and when that's completely done
you can go in and say run John it loaded one it found one and then you can say hey John
what why don't you show me what we got for Zaphod and you can see here that Zaphod's
password was in fact cracked using KRB 5 ASREP and giving us that password for the account overall
by doing roasting against ASREP. Now you're going to see things are a little bit different with TTS
or Kerber roasting roasting yes we and we'll cover that one next.