Active Directory Exploits

Kerberoasting

Kerberoasting is an attack that targets Service Principal Names (SPNs) associated with user accounts. Attackers first identify user accounts with SPNs and request a Ticket Granting Service (TGS) ticket for these accounts. The TGS ticket is encrypted using the password hash of the target account, which can be cracked offline using tools like Hashcat or John the Ripper. Once the password is obtained, the attacker can authenticate as that user, gaining unauthorised access.

🛈 A Service Principal Name (SPN) is a unique identifier for a service instance within an Active Directory domain

Attacker’s Perspective

Kerberoasting is a relatively straightforward but highly effective attack. Since the TGS ticket is encrypted with the user’s password hash, attackers with access to a network can request tickets for SPNs and attempt to crack them offline. This method is especially effective if the targeted user accounts have weak or reused passwords, enabling attackers to escalate privileges quickly. With powerful password-cracking tools available, attackers can exploit weak AD configurations, making this a go-to method for lateral movement within compromised networks.

Defender’s Perspective

Organizations can mitigate Kerberoasting risks by implementing the following defences:

• Minimise the number of SPNs: Reducing the number of accounts with SPNs minimizes the attack surface.
• Use Group Managed Service Accounts (gMSAs): gMSAs automatically rotate long, complex passwords, reducing the likelihood of successful password cracking.
• Enforce the principle of least privilege: Restricting permissions for accounts with SPNs ensures that they have only the minimum required access, limiting the damage if compromised.

Links

_{Group Managed Service Accounts Overview: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts/group-managed-service-accounts-overview}

_{Service Principal Names: https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names}

Unconstrained Delegation

Unconstrained delegation allows certain computer objects to impersonate any user that authenticates to them. When a user logs into a system configured for unconstrained delegation, their Ticket Granting Ticket (TGT) is stored in the system’s Local Security Authority Subsystem Service (LSASS). If an attacker compromises the system and gains administrative access, they can extract the TGT from LSASS using tools like Mimikatz, enabling them to impersonate the user and potentially escalate their privileges across the network.

_{🛈 A TGT is a ticket-granting ticket, a security token issued by a Kerberos KDC to authenticate a user to other services within a domain.}

Attacker’s Perspective

Unconstrained delegation offers attackers a powerful avenue for privilege escalation and lateral movement. Once a computer with unconstrained delegation is compromised, attackers can extract cached TGTs, impersonate high-privilege accounts, and gain access to sensitive resources. Tools like Mimikatz make this attack accessible, allowing attackers to harvest credentials quickly.

Defender’s Perspective

Key defence strategies to mitigate unconstrained delegation include:

• Prevent unconstrained delegation: Regularly audit AD environments to identify computer objects configured for unconstrained delegation and change their settings to constrained delegation or disable delegation entirely.
• Mark privileged accounts as non-delegable: Configuring privileged accounts as “sensitive and cannot be delegated” prevents their TGTs from being stored in systems that support delegation.
• Disable unnecessary services: Disabling non-essential services like the Print Spooler, particularly on Domain Controllers, reduces potential attack surfaces for delegation abuse.

Links

_{Kerberos Unconstrained Delegation: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation}

_{Detecting Unconstrained Delegation in AD: https://www.sentinelone.com/blog/detecting-unconstrained-delegation-exposures-in-ad-environment/}

Active Directory Certificate Services (AD CS) Compromise

Active Directory Certificate Services (AD CS) provides PKI (Public Key Infrastructure) services, enabling encryption, code signing, and user authentication. A specific vulnerability in AD CS, known as ESC1, allows any user to request a certificate on behalf of another account, even privileged ones, using misconfigured certificate templates. Once issued, these certificates remain valid even if the account’s password is changed, providing attackers with persistent access to sensitive systems.

🛈 Certificates are digital credentials issued by a trusted authority to verify the identity of a user, device, or service.

Attacker’s Perspective

AD CS misconfigurations provide attackers with a means of creating persistence within a network. By requesting certificates using the built-in tools available in Windows, attackers can perform lateral movement without raising red flags. A certificate issued via a vulnerable template (ESC1) allows attackers to authenticate as any user indefinitely, bypassing password changes or multi-factor authentication (MFA) requirements.

Defender’s Perspective

To mitigate AD CS compromises, organizations should adopt the following defences:

• Restrict certificate template permissions: Limit which users can request or modify certificates by tightening access controls on certificate templates.
• Enforce certificate manager approval: For sensitive certificate templates, require manual approval by a certificate manager to ensure each request is properly vetted.
• Restrict access to AD CS servers: Limit access to the AD CS servers to only a small group of privileged administrators and apply network segmentation to prevent unauthorized users from accessing the systems.

Links

_{Exploiting Active Directory Certificate Services: https://redfoxsec.com/blog/exploiting-active-directory-certificate-services-ad-cs/}

_{AD CS Domain Escalation: https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation}