DB.
Courses

Attacking Active Directory Authentication
OSCP · Chapter 18

Attacking Active Directory Authentication

Attacking AD authentication targets Kerberos and NTLM directly: extracting or forging tickets, and cracking service account credentials offline via Kerberoasting, rather than brute-forcing logins.

Key concepts

  • Kerberoasting: request a service ticket (TGS) for any service account with a Service Principal Name (SPN), then crack it offline — no elevated privileges required to request the ticket.
  • AS-REP Roasting targets accounts with Kerberos pre-authentication disabled, letting you request a crackable hash without any credentials at all.
  • Pass-the-Hash and Pass-the-Ticket let an attacker reuse a captured NTLM hash or Kerberos ticket without ever knowing the plaintext password.
  • Mitigations: strong, rotated service-account passwords (or Group Managed Service Accounts), enforcing AES over RC4, and monitoring for abnormal TGS request volume.

Example

# Request and crack a kerberoastable SPN account (lab only)
GetUserSPNs.py DOMAIN/user:password -dc-ip 10.10.10.100 -request
hashcat -m 13100 spn_hashes.txt rockyou.txt

Try it yourself

In an AD lab with a deliberately kerberoastable service account, request its TGS ticket with a low-privileged domain user and attempt to crack the resulting hash with a small wordlist.

ReferenceSearch video walkthroughs

@ Daniel Burlacu