38. Active Directory Attacks and Defence
38.4 Kerberos Basics: AS-REP Roasting and Kerberoasting (Defensive View)
Kerberos short path: AS-REQ → AS-REP (with TGT) → TGS-REQ → TGS-REP (service ticket). Two classic abuse ideas (lab):
AS-REP roasting: user account with Kerberos pre-authentication disabled – attacker can request AS-REP data and crack offline. Fix: enable pre-auth (default); long passwords; monitor 4768 with pre-auth type oddities.
Kerberoasting: accounts with SPN (Service Principal Name) – any domain user can request a TGS for that SPN; ticket encrypted with service account key → offline crack if password weak. Fix: long random passwords or gMSA; AES; monitor 4769 to unusual SPNs / RC4; honeytoken SPN.
Impacket tool names (lab only, against YOUR DC):
# Concepts – run only if YOU disabled pre-auth on a disposable lab user
GetNPUsers.py sahyadri.lab/ -dc-ip 192.168.56.30 -usersfile users.txt -format hashcat -outputfile asrep.txt
# Kerberoast idea – lab SPN account you created with weak password ON PURPOSE
GetUserSPNs.py sahyadri.lab/shahrukh:'YourLabPass!'@192.168.56.30 -request -dc-ip 192.168.56.30
# Crack ONLY lab hashes offline on Kali (hashcat/john) – never real hashes
Detection: Windows Security 4768/4769; honeytoken users; Azure ATP / Defender for Identity style sensors (where licensed). Ghabru naka – aadhi idea, mag lab.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Finds DONT_REQ_PREAUTH users → AS-REP roast | Ensure pre-auth required; alert on AS-REP without pre-auth; strong passwords |
GetUserSPNs.py -request → crack service tickets |
gMSA / 64+ char SPN passwords; AES-only; 4769 hunting; honeytoken SPN |
| Uses cracked service account for lateral | Service accounts: no interactive logon; Tier placement; rotate on use |
Ravindra Bagale's Tip
Once they get a Kerberoast hash, students throw a production wordlist at it. Lab hashes only. If it's a real finding, report + reset + gMSA – no cracking showcase. Interview: "What is Kerberoasting?" – SPN + TGS + weak service password + offline crack + gMSA fix. Say it clearly.
Ravindra Bagale's Tip – मराठी
Students ना Kerberoast hash मिळाला की production wordlist लावतात. Lab hash only. Real finding असेल तर report + reset + gMSA – crack showcase नको. Interview: "What is Kerberoasting?" – SPN + TGS + weak service password + offline crack + gMSA fix. Clear बोला.
Ravindra Bagale's Tip – हिंदी
Students को Kerberoast hash मिलते ही production wordlist लगा देते हैं. Lab hash only. Real finding हो तो report + reset + gMSA – crack showcase नहीं. Interview: "What is Kerberoasting?" – SPN + TGS + weak service password + offline crack + gMSA fix. Clear बोलो.
Lab
Disposable lab user: uncheck "pre-auth required" (GUI) on purpose. GetNPUsers.py ne lab hash kadha, hashcat ne crack (weak password tumhi set kela). Mag pre-auth punha enable – command fail zali pahije. Dusra step: SPN on svc_sql with weak lab password → GetUserSPNs → crack → change to 40+ random / gMSA → re-verify fail.