Quick answer: Kerberos ticket attacks are techniques targeting Kerberos, the authentication protocol of Active Directory. Golden Ticket is capturing the domain's master key (krbtgt) and forging almost unlimited privileged tickets. Silver Ticket is a forged ticket for a specific service, Pass-the-Hash is logging in with a hash instead of a password, Pass-the-Ticket is reusing a stolen ticket, and AS-REP Roasting is cracking offline the password of accounts with pre-authentication disabled. These are critical paths to domain admin in internal network penetration tests.

Why is Kerberos targeted?

Kerberos is the basis of authentication in Windows Active Directory environments. Users and services verify each other through tickets. This central trust makes Kerberos a high value target for attackers: if the protocol's trust mechanism is compromised, the attacker can spread across the whole environment by acting as a legitimate user.

Most of these attacks feed on weak passwords, over privileged service accounts and misconfigurations. So it is not Kerberos itself but the environment's configuration that creates the vulnerability.

Main Kerberos attacks

Attack What it does
Kerberoasting Taking a service account ticket and cracking its password offline
AS-REP Roasting Cracking the password of accounts with pre-authentication disabled
Pass-the-Hash Authenticating with an NTLM hash instead of a password
Pass-the-Ticket Reusing a stolen valid ticket
Silver Ticket Forging a ticket for a specific service
Golden Ticket Forging unlimited privileged tickets with the krbtgt key

Golden Ticket is the most dangerous: if the hash of the domain's krbtgt account is captured, the attacker can forge tickets with any user and privilege, and these tickets remain valid for a long time. This means de facto full control over the domain.

Defense

  1. Give service accounts very strong and long passwords (makes Kerberoasting harder).
  2. Keep pre-authentication enabled on all accounts (prevents AS-REP).
  3. Apply the least privilege principle, do not make service accounts over privileged.
  4. Rotate the krbtgt account password regularly (twice).
  5. Monitor privileged access and detect unusual ticket activity.
  6. Protect critical accounts with a tiered admin model.

The KAOS and DSET approach

In internal network and Active Directory penetration tests, DSET tests Kerberos ticket attack paths in an authorized way and ties the real path to domain admin to evidence. Our KAOS security engine evaluates paths such as Kerberoasting and AS-REP. In our field experience the most common problem is service accounts with weak passwords and over privilege, which are easy targets for Kerberoasting. Our goal is to show how resilient the domain really is.

Related reading: Active Directory attack techniques BloodHound, Active Directory internal penetration testing Kerberoasting, LLMNR NBT-NS poisoning and NTLM relay, privilege escalation and lateral movement, password cracking Hashcat John, Windows Server hardening.

Frequently asked questions

Why is Golden Ticket the most dangerous Kerberos attack? Because it uses the hash of the krbtgt account, the domain's master key. If this hash is captured, the attacker can forge Kerberos tickets with any user identity and privilege, and these tickets remain valid for a long time. This means de facto full control over the domain. For defense, the krbtgt password must be rotated regularly and twice.

How does Kerberoasting work? The attacker requests the Kerberos ticket (TGS) for a service account; this ticket is encrypted with the service account's password hash. The attacker takes the ticket and tries to crack the password offline. If the service account's password is weak, it is cracked easily. That is why giving service accounts very strong and long passwords is the most effective defense.

What prevents Pass-the-Hash? Pass-the-Hash is authenticating with an NTLM hash without knowing the password. To prevent it, you need the least privilege principle, a tiered admin model (not using admin credentials on low trust machines), unique local passwords with LAPS, and restricting NTLM use. Even if a hash is captured, an account with narrow privilege that does not work on other systems cannot do harm.

Sources

To test your Active Directory environment's resilience against Kerberos attacks, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.