Kerberoasting

Question 1

What role have Domain Controler on Kerberos too ?

Answer 1

DC = Key Distribution Center (KDC)

Question 2

What is goal of Kerberoasting ?

Answer 2

Get TGS and decrypt server’s account hash

Question 3

What steps are involved in Kerberoasting (6) ?

Answer 3

1. Request TGT (Provide NTLM hash) to DC
2. Receive TGT encrypted witg krbtgt hash
3. Request TGS for Server (Present TGT)
4. Receive TGS encrypted with server account hash
5. Present TGS for server encrypted with server’s account to App server
6. AP REP (optional)

Question 4

What are cmd for Kerberoasting (2) ?

Answer 4

1. Get SPNs, Dump Hash (Impacket)
   python GetUserSPN.py DOMAIN/username:password -dc-ip IP_DC -request
2. Crack that hash
   hashcat -m 13100 kerberoast.txt rockyou.txt -O

Question 5

What are mitigation strategie for Kerberoasting

Answer 5

• Strong passwords
• Least Privilege