{"id":2172,"date":"2024-09-25T12:05:31","date_gmt":"2024-09-25T12:05:31","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2172"},"modified":"2025-07-29T03:24:04","modified_gmt":"2025-07-29T03:24:04","slug":"active-directory-penetration-dojo-spn-tickets-and-kerberoasting","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/active-directory-penetration-dojo-spn-tickets-and-kerberoasting\/","title":{"rendered":"Active Directory Penetration Dojo \u2013 SPN Tickets and Kerberoasting"},"content":{"rendered":"\n
\"Active<\/figure>\n\n\n\n

Hi everyone, we\u2019ve discussed basics of Active Directory and different servers in AD in previous blog posts of this series. If you\u2019ve not yet read that, please find that here in [Part 1]<\/a> and [Part 2]<\/a>. We\u2019ve also understood trust relationships in AD environment which can be checked in the blogpost [here]<\/a>. Finally, we also did Active Directory enumeration which was discussed in part 4 of this series [here]<\/a>.<\/p>\n\n\n\n

Let\u2019s have a look at the current post in which we\u2019ll discuss how to enumerate an active directory domain for the service accounts and perform Kerberoasting attack.<\/p>\n\n\n\n

Kerberos<\/strong>:<\/strong><\/h2>\n\n\n\n

To understand Kerberos based attacks, let\u2019s first understand what Kerberos is, and how it works in Microsoft Active Directory Environments. Kerberos is used as the default authentication protocol used by Microsoft Windows. Kerberos authentication protocol was named after Cerberus (a big 3 headed dog) who guards the Gates to the Underworld according to myth. MIT used this name and similar kind of logo for the authentication protocol. In Windows 2000, Microsoft introduced their version of Kerberos and became the standard for SSO for other applications as well. Using the strong cryptography and third-party ticket authorization, it is surely an effective authentication protocol, but there are few flaws in its design which we will discuss so that we can understand the different attacks based on abusing Kerberos authentication flow.<\/p>\n\n\n\n

In case of Kerberos, there is a Key Distribution Centre that includes below components:<\/p>\n\n\n\n

    \n
  1. Authentication server (AS)<\/strong> \u2013 Performs the initial authentication and ticket for Ticket Granting Service<\/em><\/li>\n\n\n\n
  2. Database<\/strong> \u2013 Used by authentication server to verify access rights of users<\/em><\/li>\n\n\n\n
  3. Ticket Granting Server (TGS) –<\/strong> Issues the ticket for the Servers<\/em><\/li>\n<\/ol>\n\n\n
    \n
    \"\"<\/figure>\n<\/div>\n\n\n

    For Kerberos authentication, both the client and the server are required to be verified. Let us suppose that a client wants to connect to a target server and access a particular service on it. The client will first verify itself to the KDC (Key Distribution Centre).<\/p>\n\n\n\n

    Below are the overall steps to get verified successfully to the KDC:<\/u><\/strong><\/h3>\n\n\n\n