Kerberoasting Attack
A Kerberoasting attack is a cybersecurity threat that targets the Kerberos authentication protocol used in Windows environments. This attack aims to extract and crack service account passwords stored as Ticket Granting Service (TGS) ticket hashes. Here’s a summary of a Kerberoasting attack:
- Objective: The primary goal of a Kerberoasting attack is to obtain and crack the password hashes of service accounts within a Windows domain. These service accounts are used to run various services and are protected by the Kerberos authentication system.
- Kerberos Authentication: Kerberos is a widely used authentication protocol in Windows environments. It relies on the exchange of tickets to authenticate users and services. Service accounts often have associated TGS tickets encrypted with their passwords.
- Attack Method:
- Identification: The attacker identifies service accounts within the network, typically by querying Active Directory for accounts with servicePrincipalName (SPN) attributes.
- Ticket Request: The attacker requests a TGS ticket for a specific service account. This request can be made anonymously because TGS tickets are accessible to any authenticated user.
- TGS Ticket Extraction: Once the TGS ticket is obtained, the attacker extracts it from the network traffic or the compromised system’s memory.
- Password Hash Extraction: The attacker then extracts the encrypted TGS ticket hash, which is derived from the service account’s password.
- Cracking: The attacker uses offline password-cracking tools (e.g., Hashcat or John the Ripper) to attempt to crack the TGS ticket hash, revealing the plaintext password. This step can take time, depending on the complexity of the password.
- Service Account Compromise: If successful, the attacker gains access to the plaintext password of the compromised service account. This could lead to unauthorised access to the service or privilege escalation within the network.
- Detection Challenges: Kerberoasting attacks can be difficult to detect because they involve standard Kerberos traffic and don’t rely on brute force or excessive login attempts.
- Mitigation and Prevention: To defend against Kerberoasting attacks, organisations can consider the following measures:
-
- Regular Password Changes: Ensure that service account passwords are changed regularly to limit the exposure of password hashes.
- Service Account Management: Limit the number of service accounts and their permissions, removing unnecessary accounts.
- Use Strong Passwords: Enforce strong password policies for service accounts to make password cracking more challenging.
- Monitoring: Implement monitoring and alerting for suspicious activity related to service accounts and Kerberos authentication.
- Implement Credential Guard: Use Windows Credential Guard to protect sensitive credentials from being exposed in memory.
In conclusion, a Kerberoasting attack is a targeted threat that focuses on compromising service account passwords within a Windows domain. Organisations should take steps to protect service accounts and monitor for suspicious activity to mitigate this security risk.
Why this one matters more than it looks
Kerberoasting is quiet. It does not require elevated privileges, it does not touch the target service, and the request it makes is a normal part of how Kerberos works. That combination is why it remains one of the most reliable paths from an ordinary user account to a privileged one in a Windows environment, and why it turns up in so many internal penetration test reports.
The exposure comes from service accounts. Where a service account has a weak password and has been granted more rights than it needs, the gap between a standard domain user and domain-level access can be very short.
How to detect it
Detection is realistic here, because the pattern is distinctive even though the individual request is not.
- Monitor Event ID 4769 (a Kerberos service ticket was requested) on domain controllers. Individually this event is ordinary; the signal is one account requesting tickets for many different services in a short window.
- Alert specifically on tickets requested with RC4 encryption in an environment that should be using AES. Requesting the weaker encryption type is a strong indicator, and in most modern domains there is no legitimate reason for it.
- Deploy a honey service account: an account with a service principal name, a long random password, no real privileges and no legitimate use. Any ticket request for it is worth investigating immediately, because nothing should ever ask for one.
How to prevent it
Four controls remove most of the risk, and they are ordered by how much difference they make.
Use managed service accounts. Group managed service accounts have long, complex passwords that rotate automatically. A password that cannot realistically be cracked makes the technique pointless, and this is the single most effective fix.
Where a managed account is not possible, use a long passphrase. Service account passwords should be well beyond the length a standard user policy requires, set once and stored properly, since nobody has to type them.
Disable RC4 and enforce AES for Kerberos where your environment supports it, which raises the cost of offline cracking substantially.
Apply least privilege. The reason this technique is worth an attacker’s time is that service accounts are so often members of Domain Admins for no reason anyone can now remember. Review what those accounts actually need.
Siege Cyber is a CREST-accredited provider of penetration testing across Australia. Get a Fixed-Price Quote.