Let's talk Kerber roasting.
So in order to talk curb roasting we have to understand how curb growth itself works.
Now there is this great great info graphic here that will tell us how these things work.
So here we have a domain controller.
OK.
In this domain controller is also known as a key distribution center.
And we can call that a KDE here.
We also have our user now our user is going to need to authenticate to the Domain Controller.
When they do that they're going to say hey I want to request what is known as a ticket granting ticket
I'm going to provide my until I'm hash and I'm going to request that ticket from you.
Now the domain controller is going to send back the ticket granting ticket and it's going to encrypt
that ticket with the cross ticket granting ticket hash.
OK.
What's important here is this KDE is holding the keys right.
So we have to authenticate with the KDE that sends it back here.
And now we have a ticket granting ticket.
How did we get this ticket granting ticket.
We supplied an anti-Islam hash.
What does that mean.
We have a username and a password.
That's it.
Any valid user doesn't have to be ab and does that to be anything any valid user gets this ticket.
This is how Kirby Rosa works.
This is the authentication.
So we have Frank Castle.
We have password 1.
We have a valid ticket granting ticket.
So from here now let's say we have an application server.
This could be sequel.
This could be antivirus.
It could be whatever you want the application to be.
We just have a service that we're trying to access.
So this service here has what is called an escapee and that is a service principal name.
And that's going to come into play here in just a second.
But in order to access this service we have to first request a ticket granting service ticket or this
is a T.J..
Yes.
OK.
So we're going to request this T.J. Yes.
And how do we request this.
Well we present our TGT.
So we've already got our TGT our ticket grading ticket.
We're going to request a service ticket from the server.
Well the server knows the server account hash.
Right.
And it's going to encrypt that and send it back.
The server does not know if we the KDE or the server here does not know if we have access to the server
or not.
So it's just going to provide back to us the yes with the server account hash this is where crossing
stops.
However let's continue in order to authenticate that server in the real world or we would do is we would
present that T S to the application server and that would then decrypt it using its own server hash
and it would say yes you have authentication you are the user that is allowed on this or no.
And then it's going to send back and say yes or no we don't need to ever send that out.
This is not important.
It's important to understand what's happening and why this happens.
But the important part to understand here is we have a valid user account which gives us a ticket granting
ticket steps one into with that ticket grinding ticket then we can request a service ticket for a service
that service ticket is going to be encrypted with these servers account hash.
Why does that matter.
Well guess what.
It's a hash we can decrypt the hash.
We can try to crack the hash so we can run a tool.
It's called Get user SBN stop pi guess where it's from impact.
In fact it's awesome and we just say marvel that local Frank Castle password one we specified the Domain
Controller IP and we request.
So we're going to request this service ticket.
Right.
And guess what's gonna happen.
We're gonna get this ticket granting service ticket here.
It has the hash here.
That's encrypted with and we're just going to copy this hash and try to crack it so we're gonna put
this into hash at this big long hash so we get back and we're gonna crack it pretty easily.
So that's what we're gonna do.
Again quick refresher just to go back.
We have our ticker grinding ticket.
We request that from the KDE we get that because we have a known user account does not have to be a
domain administrator account known user account.
So once we get credentials we can attempt Kerber roasting from there.
We request this ticket granting service ticket and it's gonna send that back to us and it's going say.
Here you go.
I'm going to encrypt it with the service hash and then we don't ever have to present here.
We just take it and we try to crack that.
So let's go ahead and do this hands on and you'll see this come up again a couple of times.
So let's go ahead move on to the next video.