Red Team Basics: Pass-the-Hash & Kerberoasting – So greifen Angreifer an

In the realm of cybersecurity, understanding the basics of Red Team attacks is crucial. Two common techniques used by attackers are Pass-the-Hash (PtH) and Kerberoasting. These methods can be particularly dangerous when utilized by skilled attackers.

Pass-the-Hash (PtH) is a method where an attacker steals the NT-Hash from an infected system. Unlike regular login processes, where the actual password is transmitted, the NT-Hash is used for authentication. Tools like Mimikatz can be used to extract these hashes from memory. Once in possession of the hash, the attacker can use it to authenticate with other systems in the network, bypassing the need to crack the actual password.

This underscores the importance of controlling local admin rights, as machines with such rights can serve as easy entry points for lateral movement across the network.

Kerberoasting, on the other hand, is a different kind of attack that can be carried out even with a standard user account. It exploits the way services in Active Directory are registered using Service Principal Names (SPNs). When a user tries to access a service registered with an SPN, a Ticket Granting Ticket (TGT) is requested from the Key Distribution Center (KDC).

This ticket is encrypted with the service account's password. Although a regular user cannot decrypt this ticket, they can request and store it. They can then use offline password cracking tools to try to decipher the service account's password. This process can occur without triggering any alerts, as it doesn't involve direct interaction with the KDC.

The attacker can leverage this by using tools like Rubeus to request a ticket and then use a cracking tool like Hashcat to try and recover the password.