kerberos-authentication.md (9232B)
1 --- 2 title: "Kerberos Authentication" 3 section: "Windows" 4 sectionSlug: "windows-hardening" 5 sourcePath: "src/windows-hardening/active-directory-methodology/kerberos-authentication.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/active-directory-methodology/kerberos-authentication.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # Kerberos Authentication 14 15 For a protocol-level walkthrough of the exchanges summarized below, see Tarlogic's Kerberos article.<sup>[[3]](#references)</sup> 16 17 ## TL;DR for attackers 18 - Kerberos is the default AD auth protocol; most lateral-movement chains will touch it. 19 - Think in **three operator phases**:<sup>[[3]](#references)</sup> 20 - **AS-REQ / AS-REP** → password/hash/certificate to obtain a **TGT**. This is where **AS-REP roasting**, **over-pass-the-hash / pass-the-key**, and **PKINIT** live. 21 - **TGS-REQ / TGS-REP** → use a TGT to obtain **service tickets**. This is where **Kerberoasting**, **S4U abuse**, **delegation abuse**, and most **ticket-forging tradecraft** become relevant. 22 - **AP-REQ / AP-REP** → present the ticket to the service. This is where **pass-the-ticket** and service-specific lateral movement happen. 23 - For hands-on cheatsheets (AS-REP/Kerberoasting, ticket forgery, delegation abuse, etc.) see: 24 [Readme](/hacktricks/network-services-pentesting/pentesting-kerberos-88/overview) 25 - Use this page as the **overview / “what changed recently”** index, then jump to the dedicated pages for [Kerberoast](/hacktricks/windows-hardening/active-directory-methodology/kerberoast), [Resource-Based Constrained Delegation](/hacktricks/windows-hardening/active-directory-methodology/resource-based-constrained-delegation), [AD Certificates / PKINIT abuse](/hacktricks/windows-hardening/active-directory-methodology/ad-certificates), or [BadSuccessor / dMSA abuse](/hacktricks/windows-hardening/active-directory-methodology/acl-persistence-abuse/badsuccessor). 26 27 ## Fresh attack notes (2024-2026) 28 - **RC4 hardening changed the defaults, not Kerberos itself** – modern DC hardening focuses on the **default assumed encryption types** for accounts that do **not** explicitly set `msDS-SupportedEncryptionTypes`. After the 2026 rollout, those accounts increasingly default to **AES-only** on patched DCs, so blind `/rc4` Kerberoast assumptions fail more often. However, **explicitly RC4-enabled service accounts remain excellent offline-crack targets**.<sup>[[1]](#references)</sup> 29 - **PAC validation enforcement matters for forged tickets** – 2024 PAC-signature hardening means that **golden/diamond/sapphire/extraSID-style abuses** need more realistic PAC data and the correct signing context. Unpatched domains or domains left in compatibility/audit-style deployments stay softer targets.<sup>[[2]](#references)</sup> 30 - **Certificate-based Kerberos changed twice**: 31 - **Strong certificate binding** (KB5014754 timeline) makes sloppy certificate-to-account mappings less reliable in fully enforced environments. 32 - **CVE-2025-26647** added another hardening layer around `altSecurityIdentities` mappings that use a certificate's Subject Key Identifier. Patch level, enforcement or audit state, and explicit mapping configuration therefore matter when evaluating pass-the-certificate and related certificate-based paths.<sup>[[5]](#references)</sup><sup>[[6]](#references)</sup> For PKINIT, the KDC also validates the certificate path and checks that the issuer is trusted through the NTAuth store.<sup>[[8]](#references)</sup> 33 - **Cross-domain / cross-forest delegation abuse is still very alive** – Windows supports modern cross-realm **S4U2Self/S4U2Proxy** flows, so writable delegation attributes in another domain are still valuable. The blocker is usually tooling fidelity and trust/policy details, not protocol support. 34 - **Recursive multi-domain RBCD matters operationally** – in 3+ domain forests, **S4U2Self/S4U2Proxy** can recurse through trust referrals, and **SPN-less** abuse may require a final **`S4U2Self+U2U`** hop plus RC4-dependent ticket handling. See [Resource-Based Constrained Delegation](/hacktricks/windows-hardening/active-directory-methodology/resource-based-constrained-delegation).<sup>[[4]](#references)</sup> 35 - **Windows Server 2025 introduced delegated Managed Service Accounts (dMSAs)** and their migration logic. If you see delegated rights over OUs or service-account objects in a 2025 domain, check the dedicated [BadSuccessor page](/hacktricks/windows-hardening/active-directory-methodology/acl-persistence-abuse/badsuccessor) instead of treating it like “just another gMSA”.<sup>[[7]](#references)</sup> 36 37 ## Fast operator checks in modern domains 38 39 Before choosing a Kerberos attack path, quickly answer four questions: 40 41 1. **Which accounts are still RC4-friendly?** 42 2. **Which users do not require pre-auth?** 43 3. **Which objects expose delegation abuse?** 44 4. **Which parts of the domain are new enough to enforce recent hardening?** 45 46 ```powershell 47 # 1) Service accounts explicitly pinned to RC4 / legacy etypes 48 Get-ADObject -LDAPFilter '(|(msDS-SupportedEncryptionTypes=4)(msDS-SupportedEncryptionTypes=12))' \ 49 -Properties samAccountName,servicePrincipalName,msDS-SupportedEncryptionTypes 50 51 # 2) Service accounts with no explicit etype config 52 # (these increasingly inherit AES-only defaults on patched 2026 DCs) 53 Get-ADObject -LDAPFilter '(&(servicePrincipalName=*)(!(msDS-SupportedEncryptionTypes=*)))' \ 54 -Properties samAccountName,servicePrincipalName 55 56 # 3) AS-REP roastable users 57 Get-ADUser -LDAPFilter '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))' \ 58 -Properties userAccountControl 59 60 # 4) Delegation hot spots 61 Get-ADComputer -LDAPFilter '(msDS-AllowedToActOnBehalfOfOtherIdentity=*)' \ 62 -Properties msDS-AllowedToActOnBehalfOfOtherIdentity 63 Get-ADObject -LDAPFilter '(|(userAccountControl:1.2.840.113556.1.4.803:=524288)(userAccountControl:1.2.840.113556.1.4.803:=16777216))' \ 64 -Properties samAccountName,servicePrincipalName,userAccountControl 65 66 # 5) DC-side RC4 hardening / compatibility clues 67 Get-WinEvent -LogName System | Where-Object { 68 $_.ProviderName -eq 'Microsoft-Windows-Kerberos-Key-Distribution-Center' -and $_.Id -in 201..209 69 } 70 ``` 71 72 Practical interpretation: 73 - If **interesting SPN accounts are explicitly RC4-capable**, Kerberoasting stays cheap and fast. 74 - If most service accounts have **no explicit etype configuration**, expect **AES-only** behavior on updated 2026 DCs and plan for slower offline cracking or a different path. 75 - If **RBCD / KCD / unconstrained delegation** is present, S4U often beats brute-force. 76 - If **certificate auth** is in play, remember that a failed PKINIT path does **not** always mean the cert is useless; in many environments the same cert still works for **Schannel/LDAPS** abuse (see [AD Certificates / PKINIT abuse](/hacktricks/windows-hardening/active-directory-methodology/ad-certificates)). 77 78 ## Common Kerberos errors that change the attack plan 79 - **`KDC_ERR_ETYPE_NOTSUPP`** → The target account / DC will not use the encryption type you asked for. Stop retrying with RC4 only; supply **AES keys** or request **AES** roast material instead. 80 - **`KRB_AP_ERR_MODIFIED`** → You likely have the **wrong service key**, the **wrong SPN**, or a forged ticket that does not match the service account actually decrypting it. 81 - **`KRB_AP_ERR_SKEW`** → Your time is off. Sync to the DC before debugging anything else. 82 - **`KDC_ERR_BADOPTION`** during S4U / delegation flows → frequently means **sensitive/not-delegable users**, the wrong delegation model, or that you are trying to do **classic KCD** where only **RBCD** would accept a non-forwardable S4U2Self ticket. 83 84 ## References 85 - [1] [Microsoft Learn - Detect and remediate RC4 usage in Kerberos](https://learn.microsoft.com/en-us/windows-server/security/kerberos/detect-remediate-rc4-kerberos) 86 - [2] [Microsoft Support - Latest Windows hardening guidance and key dates](https://support.microsoft.com/en-us/topic/latest-windows-hardening-guidance-and-key-dates-eb1bd411-f68c-4d74-a4e1-456721a6551b) 87 - [3] [Kerberos (I): How does Kerberos work? – Theory](https://www.tarlogic.com/en/blog/how-kerberos-works/) 88 - [4] [Synacktiv - Exploiting RBCD in Cross-Domain & Cross-Forest Environments: Part 2](https://www.synacktiv.com/publications/exploiter-la-rbcd-en-environnements-cross-domain-cross-forest-partie-2) 89 - [5] [Microsoft Support - KB5014754 certificate-based authentication changes](https://support.microsoft.com/help/5014754) 90 - [6] [Microsoft - CVE-2025-26647 Kerberos certificate mapping vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26647) 91 - [7] [Microsoft Learn - Delegated Managed Service Accounts overview](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/delegated-managed-service-accounts/delegated-managed-service-accounts-overview) 92 - [8] [Microsoft Learn - Smart-card certificate requirements and KDC validation](https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration)