Siege T.V.

Kerberoasting Attack

A Kerberoasting attack is a cybersecurity threat that targets the Kerberos authentication protocol used in Windows environments. This attack aims to extract and crack service account passwords stored as Ticket Granting Service (TGS) ticket hashes. Here’s a summary of a Kerberoasting attack:

  1. Objective: The primary goal of a Kerberoasting attack is to obtain and crack the password hashes of service accounts within a Windows domain. These service accounts are used to run various services and are protected by the Kerberos authentication system.
  2. Kerberos Authentication: Kerberos is a widely used authentication protocol in Windows environments. It relies on the exchange of tickets to authenticate users and services. Service accounts often have associated TGS tickets encrypted with their passwords.
  3. Attack Method:
    • Identification: The attacker identifies service accounts within the network, typically by querying Active Directory for accounts with servicePrincipalName (SPN) attributes.
    • Ticket Request: The attacker requests a TGS ticket for a specific service account. This request can be made anonymously because TGS tickets are accessible to any authenticated user.
    • TGS Ticket Extraction: Once the TGS ticket is obtained, the attacker extracts it from the network traffic or the compromised system’s memory.
    • Password Hash Extraction: The attacker then extracts the encrypted TGS ticket hash, which is derived from the service account’s password.
    • Cracking: The attacker uses offline password-cracking tools (e.g., Hashcat or John the Ripper) to attempt to crack the TGS ticket hash, revealing the plaintext password. This step can take time, depending on the complexity of the password.
  4. Service Account Compromise: If successful, the attacker gains access to the plaintext password of the compromised service account. This could lead to unauthorised access to the service or privilege escalation within the network.
  5. Detection Challenges: Kerberoasting attacks can be difficult to detect because they involve standard Kerberos traffic and don’t rely on brute force or excessive login attempts.
  6. Mitigation and Prevention: To defend against Kerberoasting attacks, organisations can consider the following measures:
    • Regular Password Changes: Ensure that service account passwords are changed regularly to limit the exposure of password hashes.
    • Service Account Management: Limit the number of service accounts and their permissions, removing unnecessary accounts.
    • Use Strong Passwords: Enforce strong password policies for service accounts to make password cracking more challenging.
    • Monitoring: Implement monitoring and alerting for suspicious activity related to service accounts and Kerberos authentication.
    • Implement Credential Guard: Use Windows Credential Guard to protect sensitive credentials from being exposed in memory.

In conclusion, a Kerberoasting attack is a targeted threat that focuses on compromising service account passwords within a Windows domain. Organisations should take steps to protect service accounts and monitor for suspicious activity to mitigate this security risk.