Advanced Infrastructure Penetration Testing

Kerberos TGS service ticket offline cracking (Kerberoast)

As discussed in previous sections, Kerberos uses tickets to authenticate, thanks to a trusted third party based on symmetric-key cryptography. One of the most common attacks is Kerberos TGS service ticket offline cracking, also known as Kerberoast. With this technique, the attacker exploits the fact that most service account passwords have the same length as the domain password. In other words, you don't need to brute force both passwords because most service accounts don’t have passwords set to expire. To mitigate this attack, you need to ensure that the service account passwords are longer than 25 characters. These are the steps of the Ticket-Granting Service (TGS)