active-directory-kerberos-attacks

Kerberos Attack Playbook is a security-testing reference covering the major techniques for abusing Kerberos authentication in Active Directory environments. Written for penetration testers and red teams, it begins with a primer on the Kerberos AS-REQ/AS-REP and TGS-REQ/TGS-REP message flow, then works through credential-access and impersonation techniques with concrete tool commands.

The credential-harvesting sections cover AS-REP roasting (querying users who do not require Kerberos pre-authentication and cracking the returned hashes) and Kerberoasting (any domain user can request service tickets for accounts with SPNs and crack them offline). Enumeration and request commands are given for Impacket (GetNPUsers, GetUserSPNs), Rubeus, and PowerView, with hashcat modes (18200 for AS-REP, 13100 and 19700 for TGS) and John for cracking. The ticket-forging section distinguishes golden tickets (forged TGTs signed with the krbtgt hash), silver tickets (forged service tickets using a service account hash, with no KDC interaction), and the harder-to-detect diamond and sapphire variants that modify or reuse genuine PAC data. Delegation abuse is covered across unconstrained delegation, constrained delegation via S4U2Proxy, and resource-based constrained delegation (RBCD), followed by pass-the-ticket and overpass-the-hash.

Use it when an engagement targets AD authentication and you need the prerequisites, commands, and trade-offs for a specific technique, for instance knowing that a golden ticket requires the krbtgt NTLM hash and stays valid until that password is changed twice, or that RC4 service tickets crack far faster than AES256. The playbook notes that base models frequently blur ticket-type distinctions, delegation-chain nuances, and detection-evasion trade-offs, and it routes to related playbooks for ACL abuse, AD Certificate Services, NTLM relay, and lateral movement, plus an attack-chain reference for end-to-end scenarios from foothold to domain admin.