Ravindra BagaleCourses & study guides मराठी Track your progress

38. Active Directory Attacks and Defence

38.4 Kerberos Basics: AS-REP Roasting and Kerberoasting (Defensive View)

By Last updated:

Kerberos short path: AS-REQ → AS-REP (with TGT) → TGS-REQ → TGS-REP (service ticket). Two classic abuse ideas (lab):

AS-REP roasting: user account with Kerberos pre-authentication disabled – attacker can request AS-REP data and crack offline. Fix: enable pre-auth (default); long passwords; monitor 4768 with pre-auth type oddities.

Kerberoasting: accounts with SPN (Service Principal Name) – any domain user can request a TGS for that SPN; ticket encrypted with service account key → offline crack if password weak. Fix: long random passwords or gMSA; AES; monitor 4769 to unusual SPNs / RC4; honeytoken SPN.

Impacket tool names (lab only, against YOUR DC):

# Concepts – run only if YOU disabled pre-auth on a disposable lab user
GetNPUsers.py sahyadri.lab/ -dc-ip 192.168.56.30 -usersfile users.txt -format hashcat -outputfile asrep.txt
# Kerberoast idea – lab SPN account you created with weak password ON PURPOSE
GetUserSPNs.py sahyadri.lab/shahrukh:'YourLabPass!'@192.168.56.30 -request -dc-ip 192.168.56.30
# Crack ONLY lab hashes offline on Kali (hashcat/john) – never real hashes

Detection: Windows Security 4768/4769; honeytoken users; Azure ATP / Defender for Identity style sensors (where licensed). Ghabru naka – aadhi idea, mag lab.

Red team (attacker) does Blue team (defender) detects / stops
Finds DONT_REQ_PREAUTH users → AS-REP roast Ensure pre-auth required; alert on AS-REP without pre-auth; strong passwords
GetUserSPNs.​py -​request → crack service tickets gMSA / 64+ char SPN passwords; AES-only; 4769 hunting; honeytoken SPN
Uses cracked service account for lateral Service accounts: no interactive logon; Tier placement; rotate on use

Ravindra Bagale's Tip

Once they get a Kerberoast hash, students throw a production wordlist at it. Lab hashes only. If it's a real finding, report + reset + gMSA – no cracking showcase. Interview: "What is Kerberoasting?" – SPN + TGS + weak service password + offline crack + gMSA fix. Say it clearly.

Lab

Disposable lab user: uncheck "pre-auth required" (GUI) on purpose. GetNPUsers.py ne lab hash kadha, hashcat ne crack (weak password tumhi set kela). Mag pre-auth punha enable – command fail zali pahije. Dusra step: SPN on svc_sql with weak lab password → GetUserSPNs → crack → change to 40+ random / gMSA → re-verify fail.

Extended teaching notes

Why this lesson matters

Active Directory is the identity plane for many Indian enterprises. Attack path tools exist so defenders can remove dangerous edges: excessive admin rights, unconstrained delegation, stale accounts.

  • Tiered admin model; no daily Domain Admin use.
  • LAPS for local admin passwords.
  • Monitor for unusual Kerberos / replication behaviour.
  • Lab AD only — never against a corporate domain without a signed engagement.

Mini case study

Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.

Defender's worksheet (do this today)

  1. Write the lesson title, date and the exact lab target you are allowed to use.
  2. List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
  3. Run one safe check from the lesson on a lab system only. Paste the command and output.
  4. Write a two-sentence fix you would give a teammate.
  5. Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.

Indian workplace (sample data)

Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).

Global practice

Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.

Everyday analogy

Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.

Key terms

  • Control: a safeguard (patch, config, process, detection).
  • Finding: a weakness backed by evidence.
  • Remediation: the fix plus how you verified it.
  • Scope: systems you have written permission to touch.
  • Least privilege: only the access the task needs.
  • Defence in depth: several layers so one failure does not end the story.

Common mistakes

  • Skipping written permission "just for a quick scan".
  • Practising on hostel, office or public targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
  • Publishing screenshots that contain secrets, cookies or internal hostnames.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Fix > spectacle.