Now we're going to get into actual Kerberoasting.
This is where we're going one step further.
We've already gained access into the domain
through authentication.
Now we're trying to get a little bit further
with authorization.
As we know, the AS rep is really just
getting into the actual domain
through a username and password.
Whereas Kerberoasting with the TGS side
specifically the TGS-rep
is going in and more targeting the
service accounts.
The service accounts are very specific
accounts that have already been granted
the ability to log in
through AS rep and the Kerberos process
and have been identified as service
in their attributes for Active Directory
and run specified services
and have certain permissions with that.
I want to show you an example here real quick
that I have made a service account
in Active Directory.
This one specifically is a
just a fake account that I've made
to go and have a
service account tied to Active Directory
just for us to be able to practice with.
This is more of basically set SPN-A
to a fake Microsoft SQL database
that's running on 1433.
I'm going to tie it to svc-account.
The actual account itself was made
just like a regular user account.
I'm in managed service accounts for ADUC
and I've made an account.
That set SPN command
inside a command prompt
is nothing more than just identifying this
as a service account.
If you go into the attribute editor
of the account itself
you can see that under attribute editor
you can have a service principal name
populated and this is what specifically
identifies this account as a service account.
So not just a regular user.
Yes, you could put a regular user
in the service role,
but without this SPN area populated
it's not really a service account
in the eyes of Windows.
Kerberoasting allows us to be able
to go through and exploit these accounts
after the first part of the cycle
that ASREP cycle
and lets us utilize the permissions
of this particular account.
We've already been through the actual
Wireshark data dumping of this and everything
and it looks very similar
because you could go through Wireshark
on Kali and take a look
at the Active Directory traffic
example PCAP that I have on the desktop
and see that there are TGSREP
packets in there
that have this very same flow
as far as the actual cipher
and identification
of what kind of cipher it is.
All that basic information for you
to be able to go in there
and do some exploring if you want to.
But this looks pretty straightforward
because since we're already
authenticated with the domain
for example, using this command here
this allows us to be able to
use MPAKET to get users
of SPNs.
And commands below as always
and we're going to request
from the actual DC IP address
in the Texas.Test
under Eric's account.
Now because this is using Eric's account
it assumes that we've already
completed the ASREP portion of this.
We've already cracked somebody's user account
so we could very well be using
Zafon's account here since we've already
cracked the password for that.
In fact, let's do so.
So let's delete Eric there
and use Zafon
and then it's going to ask us
for the actual password itself
for Zafon's account.
Since we've already cracked it
we know it's PAT$$WORD
and this gives us a
basically a data dump
of what's going on with
service accounts. Now I'm going to zoom in
and show you this real quick.
We can see that this is
a service account
listing. I should probably
highlight some stuff for you.
Right here
you can see that we have
all the basic user account info
basically in what I'm
going to call hashcat format
with the dollar signs
and everything like that so we know
that we can go and do a password attack on this.
So it's in
KRB 5 TGS
which is telling us critical information
for how we're going to use John for this one.
And then type 23
which is actually
a little bit better because this is an RC4
and it's
attacking the actual
service account.
On the Texas.Test
domain in
Texas.Test
and the rest of this
is nothing more than just the actual
output of the password
in that particular hash.
Now to go one step
further all we have to do at this point
is do sudo john
and again I'll have this one below and I'm going to
be using the short.txt. That will
allow us to be able to complete this
hashing pretty quickly
and not have to wait
the realistically long
process of actually busting this
hash. Now when you do
run this just keep in mind that
half of the evidence was already
given to you as far as formatting because
that's KRB
5 TGS
up at the very top when we ran our
mpacket command. So when you run
john and again the command below
you'll be running john against
the actual short word list
for KRB 5 TGS
and the service.txt that
I've made for you on the desktop
because I've copied all of this right here
and put it in an actual
text file for you.
And when you run this
I've already ran it behind the scenes to make sure it worked
but in order to verify
you can say sudo
actual john
dash dash
show and then the actual
file itself
or svc
and then you can tab over
and you can see that one
password hash was cracked
and it has a question mark there but we know that's it
because that's the password that was set
as I zoom in and show you here
after I get that out of the way.
So it's
$$ and that right there
allows us to be able to go through and
use roasting
and kerberoasting together
to start getting more passwords
and collected information
for the actual
domain itself overall.
But it should go without saying
that this does tie into
doing a lot of reconnaissance
and playing into
the previous skills leading up
to this in the course.
Because there's a lot of different steps
and processes along the way
to where we have to do
enumeration, we have to get
actual usernames,
domain information,
LDAP information,
all sorts of different pieces of the puzzle
have to be put together in order for us to be
able to get to this point right here
and make the most out of it.
Now just because it's easy
for us to be able to do it here doesn't
necessarily mean that it's going
to be easy out in the wild
because a lot of what we're doing
here is in
a lab environment that's been opened
up ever so slightly
to make it easier for us to practice
the actual skills themselves.
When you actually go out
into the wild a little yonder out there
to practice this for real,
you will notice that some
of the ports and
IDS and IPS rules
out there will
start to see things like this a little
bit more often and
make things a little bit more difficult for
us. But knowing the actual core
principles of what's involved
in how to do this
make it a whole lot easier to be able to
work around and circumvent some of those
security features to do a proper
pen test.