Skip to content

Back to the catalog

Kerberosity Killed the Domain: An Offensive Kerberos Overview
hausec.comarticle

Kerberosity Killed the Domain: An Offensive Kerberos Overview

A deep-dive walkthrough of how Kerberos authentication works in Active Directory (AS-REQ/AS-REP, TGT/TGS, PAC) and the corresponding attack primitives: AS-REP Roasting and Kerberoasting for offline hash cracking, Golden/Silver Ticket forgery via KRBTGT and service-account hashes, and the three delegation models (Unconstrained, Constrained via S4U2Self/S4U2Proxy, and Resource-Based Constrained Delegation) including printer-bug coercion, using tools like Rubeus, Mimikatz, PowerView, PowerMad, and SpoolSample.

TL;DR Offensive walkthrough of Kerberos internals and every major AD ticket-abuse technique, from AS-REP roasting to RBCD.
Open original ↗

Organisations named here

  • Constrained Delegation
  • Elad Shamir
  • harmj0y
  • Kevin Robertson
  • KRBTGT
  • printer bug
  • Resource-Based Constrained Delegation
  • S4U2Proxy
  • S4U2Self
  • Unconstrained Delegation

Technologies named here

  • Rubeus
  • Windows domain / Active Directory
  • Kerberos
  • Mimikatz
  • Wireshark
  • Windows 2000
  • Windows Server 2003
  • SpoolSample
  • Windows Server 2012
  • PowerView
  • PowerMad
  • KRBTGT account
  • Active Directory
  • PowerShell

Techniques named here

  • AS-REP Roasting
  • Kerberoasting
  • Golden Ticket
  • Silver Ticket
  • Unconstrained delegation abuse
  • Printer Bug coercion
  • Constrained Delegation abuse
  • Resource-Based Constrained Delegation abuse

Related in Offensive Security