Attacking Active Directory - Kerberoasting

Kerberoasting is an extremely useful attack method to establish persistence, lateral movement, or privilege escalation in a Windows Active Directory environment. This attack is caused by a user requesting a TGS for an account, typically a service account, that has a Service Principal Name (SPN) associated with it. An attacker could then use the TGS which is encrypted with the service account's NTLM password hash to crack the hash offline.
This video uses GetUserSPNs.py from Impacket.
Join my new Discord server: discord.gg/9CvTtHqWCX
Follow me on Twitter for updates: / 0xconda
If you found this video helpful and would like to support future creations, please considering visiting the following links:
Buy Me a Coffee: www.buymeacoffee.com/conda
Check out Impacket: github.com/SecureAuthCorp/imp...
00:00 What is Kerberoasting
05:06 Kerberoasting Setup in Lab
07:40: Kerberoasting Demo
12:21 Kerberoasting Mitigation

[@plugandplayreviews]

CONDA is the best infosec UA-camr of all time. Respect bro!!

[@c0nd4]

Thanks so much!

[@ElCyberWizard]

I’ve been working on my GPEN cert and your content has been very helpful with tying everything together at the end of each section!

[@dawnS33ker]

Very clear and concise video. Thank you Brandon,

[@Xx-nd1rs]

I like the way you explain things, very simple, clear, informative, organized and get to the point. thanks a loot!

[@c0nd4]

Thank you!

[@randomguy3784]

Neat and Comprehensive presentation!
Great work man.

[@c0nd4]

Thank you!

[@Stephanus21]

Thank you , just started to watch your stuff and you do an amazing job of showing and explaining exactly how it works , thank you so much!

[@c0nd4]

Thank you!

[@x7331x]

Great on-point explanation of the attack 👏

[@csheldon3636]

Excellent video. A lot easier than the OSCP explanation.

[@chrislearnsIT]

Thanks for the high quality content! I just subscribed.

[@c0nd4]

Thank you!

[@Eggsec]

Thank you for the valuable information much appreciated.

[@offlife77]

Awesome mate, keep them coming!

[@DanEather]

Great vid. Clearly presented. Thanks!

[@teedeearr]

I found this very informative. Thanks

[@jaylal4899]

Very good video! It's much easier to understand kerberoasting with a practical example. Any chance you can make a video on how to compile windows kernel exploits using Visual Studio?

[@crash9706]

Yesss more AD. Love the content. Keep it up ❤️

[@c0nd4]

Thanks! I appreciate it

[@harshil.]

Great video bro definitely enjoyed it the whole way through. I'm sure this video will get a bunch of traction now that AD is on the OSCP lmao

[@c0nd4]

I appreciate it!

[@morality1995]

I'm literally watching this video prepping to take the new OSCP exam lol

[@heibai0139]

Great video, much helper than OSCP 23' course materials, appreciate

[@jcgm666]

Very good explanation! Subscribed

[@c0nd4]

Thank you!

[@ca7986]

You are awesome mate! Gold videos. ❤️

[@c0nd4]

Thank you! Really appreciate it

[@quentingauthier430]

Dude, you make awesome videos

[@c0nd4]

Thank you! I really appreciate the support

[@aahringer]

Well done! Thank you!

[@GodlyTank]

Thanks a bunch for this

[@real.xplo1t]

Perfect explanation

[@c0nd4]

Thank you!

[@vikassrivastava2058]

Great content

[@grandmakisses9973]

Let’s go, I love ad vids

[@c0nd4]

Me too! Can't wait to do more

[@enleak]

Lets goo!

[@aahringer]

Thanks!

[@c0nd4]

Thank you so much! Very kind of you!

[@Umar0x01]

Best!!!

[@quad7375]

can you go over more AD attacks, golden ticket, silver, dc sync, etc

[@ajayk643]

Subscribed :) :)

[@danielriofrio199]

Hey! I was wondering if you could explain something to me please:
Per MITRE ATTACK definition of kerberoasting: "Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline Brute Force attacks that may expose plaintext credentials."
This will result in windows log eid 4769 with encryption type 0x17.
Is this the only time that this is dangerous? Only if this type of encryption was used?
Working on a SIEM alarm to detect potential malicious kerberoasting :)

[@adamraserovaquera]

11:18 A question here, how can yo know that what etype you are searching for is the TGS-REP 23 and not lets say... the TGS-REP 18 that its at its side?

[@matiashuartamendia7977]

is it really NTLM hash inside the service account? I think that RC4 etype encrpytion of that password is equal to NTLM Hash, but AES-128 or AES-256 is completely different. Hashcat would take a LOT of time to decrypt it if password is strong enough.

[@underrated_mono9770]

If hostname of the SPN "DC-1" is replaced with another hostname, does it affect the Kerberoasting operation here?

[@eanglyroeurn8255]

Bro Please help to create more video relate to AD attack, I knew that me and someone here will need that resource for OSCP fighting.

[@DinoDulayAwil]

Does the tool execution leave some footprint on the server for detection?

[@DinoDulayAwil]

I understand it requires a compromised account (normal account will do), can we use other abuse technique that does not require one? A different vector somehow. Thanks.

[@c0nd4]

The most common way I've seen this vector detected is from SPN enumeration. If you made a request to list all SPNs, some EDR programs may catch it.

[@giovanniguarino588]

Thank you for your explaination, but this is a very little part of kerberoasting.

[@redreacts2388]

I'm taking a course right now that I paid for, but this was a far better explanation on how to exploit this vulnerability.....smh

[@lmfao69420]

Let's go Brandon!