Learn Active Directory Kerberoasting

jh.live/altere... || Learn on-premise Active Directory & Azure Active Directory penetration testing and get certified with Altered Security! jh.live/altere...
🔥 TH-cam ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware

[@syxdev]

This guy is unstoppable, never misses a video, so damn consistent,❤

[@TehStoni]

as a CRTE and CARTP holder, im glad to see alteredsec sponsoring the video. hopefully we'll see the certs appear on more job posting.

[@phillydee3592]

So by just getting a user on a domain you can get the TGT and TGS from the domain controller,cos it sees you as an authenticated user on the system..

[@brand0n.]

Mostly amazed by the absence of any huge walls of red text when powershell encounters some syntax error

[@rationalbushcraft]

Thanks. I have done kerberoasting before but never understood what I was doing at this level. Super cool stuff.

[@burekhacks]

So this is why you've been asking twitter for the password? 😂

[@vaibhavamishra7157]

😂😂😂😂😂

[@GebzNotJebz]

It's amazing how a 22 minute video about kerberoasting only has about 2 minutes worth of kerberoasting

[@MR.BONES007]

I’m sayin😂

[@KJC2025]

Good stuff John. Thanks.

[@nytr]

I still miss the honey badger video :(

[@christophercahall3092]

I was contemplating sending a secret message to kelly ripa on X saying that I learned that she was basically on soultrain from Questlove.

[@federicoleonardi5421]

Great job...greetings from italy

[@jcgm666]

Great video man!

[@josephalan31]

Simply amazing!!!

[@christianbally7507]

Question. When you are enumerating the SPNs are the ones that are vulnerable the user must have access to correct? So if the HTTP SPN was vulnerable but the user did not have access to it they would not be able to get that TGS right?

[@BrownCoatFan]

SPNs are not hidden. Everyone has access to them.

[@christianbally7507]

I understand that. But not everyone has access to request the tgs correct? I.e sql server. Not everyone can get this ticket as only privileged accounts should be able to access it so the attacker would need to compromise this type of account. but if the compromised account was a normal user and requested the tgs wouldn’t it be not granted correct..?

[@Nawdiral]

Everyone can request a TGS, Domain Controller only provides Security Info about the user (PAC), it's up to the Service Account itself to check the user's rights in the TGS.
The Security concern here is that DC use a piece of the secret of the requested service to encrypt the TGS which can be later used to brute force/crack the password.

[@starlox0]

Awesome content 👏

[@50PullUps]

So many of these attacks rely on already having domain admin or schema admin, or assume that the IT staff is hopelessly incompetent.

[@BeWhoYouWant2]

They often are

[@BrownCoatFan]

No, domain admin and schema admin are not required for Kerberoasting. Those were just used to set up an SPN in AD so that he had something to attack. The actual Kerberoasting was just the last 2 minutes of the video.

[@ancestrall794]

​@@BrownCoatFanThanks

[@jocamp5]

And there are plenty of incompetent AD admins out there .

[@alimustafa2682]

Finally man

[@Tonib760]

Any valid coupons for CRT? :)

[@iblackfeathers]

thanks 👍

[@NamikageJoel19]

What windows server version did you use ?

[@josephmensah2116]

@hammond
What OS do run on your baremetal ?

[@seansingh4421]

Most likely either a MacOS or an SE Linux distro

[@rouissi_iheb]

🔥🔥🔥🔥🔥

[@Smoth48]

That's crazy - how does a typical AD setup prevent this? Is there some other system/service in place that prevents you obtaining hashes in the first place, or is it more so a matter of good password strength policies so that something like John can't crack the hashes as easily?

[@BrownCoatFan]

Yes, use a very long (25 characters) and complex password.

[@Nawdiral]

Prefer GMSA if your App/System supports it. If not, a long, very complex password could help...

[@brylozketrzyn]

​@@NawdiralgMSAs are so nice. Password lifetime of 24hrs and with length of 120chars. Also, they do not pretend to be user accounts.

[@fatherdani]

Use excalidraw next time 😂

[@niffdjfm8345]

Alh4zr3d, is it you 🤨🤭😅🥳

[@logiciananimal]

It is a shame there's no easy way to snapshot an AD, no?

[@hoodietramp]

😃 🚀 ❤️

[@Tech69YT]

first

[@baxsm]

👑 here's your crown

[@Tech69YT]

@@baxsmthanks bud

[@nayzak69]

Frist hehe

[@zzsql]

You know, talking this fast, you're not really teaching anything as much as blowing through content that isn't digestible by people.

[@CR7andJP]

I like you, but this one was a weak video. The whole scripting thing is way too much to "learn Active Directory Kerberoasting".

[@ololh4xx]

i mean .... yeah; with domain admin privileges anything is possible. So? Thats like saying "root bad! root evil!". Yes. Yes, it is. Very. Much more than you can imagine. So?

[@_JohnHammond]

Kerberoasting is done from any low privilege domain user. We used the domain user account "Alice".

[@scottspa74]

Every time I watch @johnhammond I just feel like an idiot, so unworthy 😞

[@BeWhoYouWant2]

I actively despise AD and I don't even have a logical reason for it. just gut feeling.

[@justethical280]

Pretty useless information if you have a minimum requirement of at least 13 characters with good complexity , a good EDR installed etc.....

[@josephmensah2116]

@hammond
What OS do run on your baremetal ?

[@dungphamvu3463]

If you mean OS running on his real machine then it's Windows 10