Kerberos

Resources

• By ATTL4S : https://www.youtube.com/watch?v=4LDpb1R3Ghg&list=PLwb6et4T42wyb8dx-LQAA0PzLjw6ZlrXh&index=2
• By hackndo : https://en.hackndo.com/kerberos/
• By habr : https://habr.com/ru/articles/803163/
• By vbscrub : https://web.archive.org/web/20241001155415mp_/https://vbscrub.com/2020/05/13/kerberos-protocol-explained/
• By rougelynn : https://www.roguelynn.com/words/explain-like-im-5-kerberos/
• By blackarrow : https://www.tarlogic.com/blog/how-kerberos-works/
• SPN by Microsoft : https://learn.microsoft.com/en-us/archive/technet-wiki/717.service-principal-names-spn-setspn-syntax
• By ardent101 : https://ardent101.github.io/posts/kerberos_theory/
• By pro-ldap : https://pro-ldap.ru/tr/zytrax/tech/kerberos.html
• By sheerazali : https://sheerazali.com/how-to-kerberos-its-components-and-function/
• By redforce : https://blog.redforce.io/windows-authentication-attacks-part-2-kerberos/
• Decrypt Kerberos traffic : https://medium.com/tenable-techblog/decrypt-encrypted-stub-data-in-wireshark-deb132c076e7 || https://dirkjanm.io/active-directory-forest-trusts-part-two-trust-transitivity/#debugging-kerberos-the-easy-way
• Kerberos Errorism : https://blog.zsec.uk/common-tool-errors-kerberos/

Cheat Sheet

• snovvcrash : https://ppn.snovvcra.sh/pentest/infrastructure/ad/kerberos/

Commnads

• Synchronize Time
  • ntpdate

    ntpdate -u 192.168.99.30

  • faketime

    DC_IP="192.168.99.30"
    DC_TIME=$(ntpdate -q $DC_IP | head -1 | awk '{print $1, $2}')
    echo "DC time: $DC_TIME"
     
    faketime "$DC_TIME" impacket-getTGT 'redteamrecipes.com/tsoprano' -hashes :01ee11c4a4fc6293f3b12ce84632ee5e -no-pass -dc-ip $DC_IP

  • LDAP