🎫Kerberoasting from Windows

📋 Overview

Kerberoasting from Windows provides multiple approaches ranging from manual techniques using built-in tools to automated methods with specialized frameworks. Windows-based Kerberoasting offers advantages including native tool integration, direct memory manipulation capabilities, and access to powerful enumeration frameworks like PowerView and Rubeus. Understanding both manual and automated approaches ensures versatility across different engagement scenarios and defensive controls.

🎯 Strategic Context

🔧 Windows vs Linux Kerberoasting

  • Native Integration: Direct access to Windows AD tools and PowerShell frameworks

  • Memory Manipulation: Ability to extract tickets directly from LSASS memory

  • Tool Diversity: Multiple approaches from manual to fully automated

  • Stealth Options: Built-in tools blend with legitimate administrative activity

  • Advanced Features: Encryption type manipulation and ticket caching capabilities

⚡ Attack Scenarios

  • Domain-joined Windows host: Authenticated as domain user

  • Windows attack host: Non-domain joined with domain credentials

  • Compromised workstation: Local admin or SYSTEM privileges

  • Administrative access: Domain admin performing "legitimate" activities

  • Restricted environments: When external tools are blocked or monitored

🔧 Semi-Manual Kerberoasting Method

📊 Phase 1: SPN Enumeration with setspn.exe

Example SPN Enumeration Output:

🎫 Phase 2: Manual TGS Ticket Request via PowerShell

Understanding the PowerShell Commands:

  • Add-Type -AssemblyName System.IdentityModel: Loads .NET framework class for security tokens

  • System.IdentityModel.Tokens.KerberosRequestorSecurityToken: Creates Kerberos TGS ticket requests

  • -ArgumentList: Specifies the target SPN for ticket request

  • Tickets loaded into memory: Available for extraction with Mimikatz

Example TGS Ticket Request Output:

💾 Phase 3: Ticket Extraction with Mimikatz

Example Mimikatz Extraction:

🔄 Phase 4: Ticket Processing for Hashcat

Expected Hash Format:

🔐 Phase 5: Offline Cracking

⚡ Automated PowerView Method

🔍 SPN Enumeration with PowerView

Example PowerView SPN Output:

🎫 Targeted Ticket Extraction

Example Targeted Ticket Output:

🚀 Rubeus: The Ultimate Kerberoasting Tool

📚 Rubeus Overview and Capabilities

📊 Statistical Analysis with Rubeus

Example Statistics Output:

🎯 Targeted High-Value Account Extraction

Example High-Value Target Output:

🎯 Advanced Rubeus Features

🔐 Encryption Types Analysis

📊 Understanding Kerberos Encryption Types

Type

Encryption

Hashcat Mode

Cracking Difficulty

Hash Format

23

RC4_HMAC_MD5

13100

Easy/Fast

$krb5tgs$23$*

17

AES128_CTS_HMAC_SHA1_96

19600

Hard/Slow

$krb5tgs$17$*

18

AES256_CTS_HMAC_SHA1_96

19700

Very Hard/Very Slow

$krb5tgs$18$*

⚡ RC4 vs AES Performance Comparison

RC4 Cracking Example:

AES256 Cracking Example:

🔄 Encryption Type Downgrade Attack

msDS-SupportedEncryptionTypes Values:

🎯 HTB Academy Lab Solutions

📝 Lab Questions & Solutions

🔍 Question 1: "What is the name of the service account with the SPN 'vmware/inlanefreight.local'?"

Complete Lab Workflow:

Solution Process:

Actual Lab Output:

✅ Answer: svc_vmwaresso

🔐 Question 2: "Crack the password for this account and submit it as your answer."

Complete Attack Chain (using same RDP session):

Step 1: Navigate to Tools Directory

Step 2: Extract Kerberos Ticket with Rubeus

Actual Rubeus Output:

Step 3: Save Hash and Crack on Attack Machine

Actual Hashcat Cracking Results:

✅ Answer: Virtual01

Key Lab Details:

  • Service Account: svc_vmwaresso

  • SPN: vmware/inlanefreight.local

  • Encryption Type: RC4_HMAC_DEFAULT (easy to crack)

  • Password: Virtual01 (found in rockyou.txt wordlist)

  • Hashcat Mode: 13100 (Kerberos 5, etype 23, TGS-REP)

🔧 Advanced Windows Kerberoasting Techniques

🎯 Stealth Considerations

🔍 LDAP Filter Examples

🔄 Automation Script Example

🛡️ Mitigation and Detection

🔧 Defensive Measures

  • Managed Service Accounts (MSA/gMSA): Use accounts with automatically rotated complex passwords

  • Strong Passwords: 25+ character passphrases for service accounts

  • Regular Rotation: Frequent password changes for service accounts

  • Minimal Privileges: Service accounts should not have unnecessary elevated rights

  • Remove RC4: Disable RC4 encryption (test carefully for compatibility)

📊 Detection Strategies

🔍 Group Policy Configuration

⚡ Quick Reference Commands

🔧 Essential Windows Kerberoasting Workflow

📊 Tool Comparison Matrix

Method

Stealth

Speed

Features

Requirements

setspn + PowerShell + Mimikatz

High

Slow

Manual control

Built-in tools

PowerView

Medium

Fast

Good filtering

PowerShell module

Rubeus

Low

Very Fast

Extensive features

External binary

🔑 Key Takeaways

✅ Windows Kerberoasting Advantages

  • Multiple Approaches: From manual to fully automated

  • Native Tool Integration: Built-in Windows tools for stealth

  • Advanced Filtering: Sophisticated targeting capabilities

  • Encryption Control: Ability to manipulate ticket encryption types

  • Memory Access: Direct ticket extraction from LSASS

🎯 Strategic Considerations

  • Encryption Types: RC4 vs AES dramatically affects cracking time

  • Target Prioritization: Focus on admincount=1 and Domain Admin group members

  • Stealth vs Speed: Balance tool choice with detection risk

  • Environmental Factors: Windows Server version affects encryption downgrade attacks

⚠️ Operational Notes

  • Windows Server 2019: Encryption downgrade attacks don't work

  • AES vs RC4: 4+ minutes vs 4 seconds cracking time difference

  • Detection Risk: Rubeus generates more logs than manual methods

  • Timing Controls: Use delay and jitter for stealth operations

🚀 Post-Exploitation Opportunities

  • SQL Server Access: Use MSSQL service accounts for xp_cmdshell

  • RDP/WinRM Access: Test cracked credentials across domain systems

  • File Share Access: Service accounts often have broad file system rights

  • Additional SPNs: Service accounts may have multiple SPNs registered

Windows-based Kerberoasting provides the most comprehensive and feature-rich approach to this attack, offering everything from stealthy manual techniques to powerful automated frameworks that can extract and process tickets at scale.

PreviousKerberoasting from LinuxNextACL Enumeration

Last updated