Kerberoasting is a post-exploitation attack used to extract service account credentials from a Windows Active Directory environment. Below are the steps involved in performing a Kerberoasting attack along with the necessary commands.
1. Bypass PowerShell Execution Policy
Before running scripts, bypass PowerShell's execution policy:
powershell -ep bypass
2. Import PowerView Module
Load PowerView, a tool for Active Directory enumeration:
. .\PowerView.ps1
3. Identify Service Accounts with SPNs
Find user accounts with associated Service Principal Names (SPNs):
Request a Kerberos service ticket for a specific service account:
7. Extract Kerberos Tickets using Mimikatz
Use Mimikatz to export the tickets for offline cracking:
8. Crack the Extracted Ticket
Using a Python Script
Using Hashcat for Faster Cracking
-m 13100 specifies Kerberos 5 TGS-REP as the hash type.
Conclusion
Kerberoasting is an effective attack to extract service account credentials. After obtaining the password, you can escalate privileges or move laterally within the network.
Defensive Measures:
Enforce strong passwords for service accounts.
Implement monitoring for abnormal Kerberos requests.
Limit service accounts’ privileges to minimize the impact of compromise.
