Labs / Active Directory, defender view
Six service tickets in twelve seconds
Filter a domain controller’s 4769 events for RC4-encrypted service tickets. Separate one legacy scanner from the user who asked for six service accounts’ tickets at once.
Briefing
Kerberoasting starts with requesting service tickets for accounts that have SPNs. Any domain user can do it, and the ticket is encrypted with the service account’s password hash, so it can be cracked offline.
Modern clients ask for AES (encryption type 0x12). Tools that want a crackable ticket ask for RC4, type 0x17. You have DC-01’s Security log on a PowerShell prompt.
DC-01 · Active Directory, defender view
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.