# Kerberoasting

{% embed url="<https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting>" %}

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FiVFBWOxvQg4qGEaQmUpX%2FUntitled%20picture.png?alt=media&#x26;token=8c372777-5954-48de-93b6-1cccbf9e3b9f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FeKtrsyuFibq0kFvd24Cd%2FUntitled%20picture.png?alt=media&#x26;token=6d393c21-5747-4b77-a428-528c2094a1b6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fbj2HbpDTjQHPM09IQqko%2FUntitled%20picture.png?alt=media&#x26;token=376a224e-6d6c-401a-8aab-cece160d1431" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FO7CZfT4G68VFdHPyTCQt%2FUntitled%20picture.png?alt=media&#x26;token=5f31d700-8214-4e12-9b3a-1282b1a165a5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fgmif4Cjl9O32BrfkOS9A%2FUntitled%20picture.png?alt=media&#x26;token=c685e285-d08b-4b94-be65-1cea66273283" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F8YKMjutiypr7DtLPFAQ3%2FUntitled%20picture.png?alt=media&#x26;token=3e9a31c1-9ef3-480a-b1b4-95d3551ac3a9" alt=""><figcaption></figcaption></figure>

{% embed url="<https://www.youtube.com/watch?v=Uidc-Qbv4Bg>" %}

{% embed url="<https://github.com/nidem/kerberoast>" %}

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F32rdIZhD00cZArGmECpo%2FUntitled%20picture.png?alt=media&#x26;token=1a2e71b3-1382-4a85-8836-41c77f83e215" alt=""><figcaption></figcaption></figure>

**PTT from Mimikatz**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fhx2ewCbllyGquiPc6OkF%2FUntitled%20picture.png?alt=media&#x26;token=f356fdcb-fd27-42a6-a9c7-bf868594710d" alt=""><figcaption></figcaption></figure>

Overpass the hash will use the NTLM hash to get a TGT ticket

{% embed url="<https://blog.harmj0y.net/redteaming/kerberoasting-revisited/>" %}

{% embed url="<https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast>" %}

{% embed url="<https://www.youtube.com/watch?v=4G-jteMC2d4&feature=emb_imp_woyt&ab_channel=SathvikTechtuber>" %}
