Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.

SKILL: Kerberos Attack Playbook — Expert AD Attack Guide AI LOAD INSTRUCTION : Expert Kerberos attack techniques for AD environments. Covers AS REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass the ticket, and overpass the hash. Base models miss ticket type distinctions, delegation chain nuances, and detection evasion trade offs. 0. RELATED ROUTING Before going deep, consider loading: [active directory acl abuse](../active directory acl abuse/SKILL.md) for ACL based AD attacks often chained with Kerberos [active directory certificate services](../active directory certificate services/SKILL.md) for ADCS based persistence (golden certificate) [ntlm relay coercion](../ntlm relay coercion/SKILL.md) for NTLM relay attacks that complement Kerberos abuse [windows lateral movement](../windows lateral movement/SKILL.md) after obtaining tickets for lateral movement Advanced Reference Also load [KERBEROS ATTACK CHAINS.md](./KERBEROS ATTACK CHAINS.md) when you need: Multi step attack chains combining Kerberos with ACL abuse, ADCS, and relay End to end scenarios from foothold to domain admin Chained delegation attack flows 1. KERBEROS AUTHENTICATION PRIMER 2. AS REP ROASTING Users with "Do not require Kerberos preauthentication" can be queried for AS REP without knowing their password. Enumerate Vulnerable Users Crack AS REP Hash 3. KERBEROASTING Any domain user can request TGS for accounts with SPNs. The TGS is encrypted with the service account's NTLM hash. Request Service Tickets Crack TGS Hash 4. TICKET FORGING — GOLDEN, SILVER, DIAMOND, SAPPHIRE Golden Ticket Forge TGT using the krbtgt hash → impersonate any user, including non existent ones. Prerequisites : krbtgt NTLM hash (from DCSync or NTDS.dit) Persistence : Valid until krbtgt password is changed twice Silver Ticket Forge TGS using the service account's hash → access specific service only, no KDC interaction. Target Service SPN Format Use Case File shares cifs/host Access SMB shares WinRM http/host Remote PowerShell LDAP ldap/dc DCSync like queries MSSQL MSSQLSvc/host:1433 Database access Exchange http/mail.domain.com Mailbox access Diamond Ticket Modify a legitimately issued TGT → harder to detect than golden ticket. Advantage : The ticket's metadata (timestamps, enc type) matches a real TGT issuance. Sapphire Ticket Uses S4U2Self to get a real PAC for the target user, then embeds it in a forged ticket. Advantage : PAC is a genuine copy from KDC, making detection extremely difficult. 5. DELEGATION ATTACKS Unconstrained Delegation Hosts with unconstrained delegation store user TGTs in memory. Constrained Delegation (S4U2Proxy) Resource Based Constrained Delegation (RBCD) Requires write access to msDS AllowedToActOnBehalfOfOtherIdentity on the target. 6. PASS THE TICKET & OVERPASS THE HASH Pass the Ticket Overpass the Hash (Pass the Key) Use NTLM hash to request a Kerberos TGT → pure Kerberos authentication (avoids NTLM logging). 7. KERBEROS DOUBLE HOP PROBLEM When authenticating via Kerberos across two hops (A → B → C), B cannot forward A's credentials to C by default. Solutions Method How Risk CredSSP Sends actual credentials to B Credential exposure Unconstrained delegation on B B stores A's TGT Over privileged Constrained delegation B allowed to delegate to C Preferred — scoped RBCD C trusts B to delegate Modern, flexible Invoke Command nested Credential param in nested session Exposes password in script 8. KERBEROS ATTACK DECISION TREE

active-directory-kerberos-attacks