GO KALI FREE
AdvancedActive Directory

Kerberos Explained: Authentication Protocol Deep Dive

An in-depth exploration of the Kerberos authentication protocol covering ticket types, the authentication process, security weaknesses, and attack techniques like Kerberoasting and AS-REP roasting.

#Kerberos#Authentication#Active Directory#TGT#Kerberoasting

The Backbone of Enterprise Authentication

Kerberos is the foundation of authentication in modern Windows networks. As the default authentication protocol for Active Directory, it represents a critical architectural component of enterprise identity infrastructure. Designed by MIT in the 1980s, Kerberos provides mutual authentication between clients and servers using symmetric key cryptography and a trusted third-party authentication service — a design that eliminates password transmission while introducing its own attack surface.

Prerequisites

  • **Active Directory Fundamentals** — Understanding of domains, domain controllers, and AD architecture
  • **Networking Basics** — Knowledge of TCP/IP, ports, and network protocols
  • **Symmetric Cryptography** — Basic understanding of encryption and hashing concepts

    • Kerberos Core Concepts

    The Key Distribution Center (KDC)

    The KDC is the core service that issues Kerberos tickets. In Active Directory, the KDC runs on every Domain Controller as part of the Kerberos Key Distribution Center service. The KDC has two components:

  • **Authentication Service (AS)** — Issues Ticket Granting Tickets (TGTs)
  • **Ticket Granting Service (TGS)** — Issues Service Tickets (TGSs)

    • Kerberos Tickets

    Kerberos uses two types of tickets:

    Ticket Granting Ticket (TGT) — Issued by the AS when a user first authenticates. The TGT is encrypted with the KDC's secret key (the KRBTGT account hash) and allows the user to request service tickets without re-entering their password. TGTs have a default lifetime of 10 hours in Windows.

    Service Ticket (TGS) — Issued by the TGS when a user requests access to a specific service. The service ticket is encrypted with the target service account's secret key. Service tickets typically have a lifetime of 1 hour.

    The KRBTGT Account

    The KRBTGT account is a special disabled user account in every AD domain whose password hash is used to encrypt all TGTs in that domain. The KRBTGT hash is the most secret key in an AD domain — compromising it allows forging TGTs (a golden ticket attack).

    Kerberos Ports

    Kerberos uses UDP/TCP port 88 for ticket exchange. The KDC typically listens on both UDP 88 and TCP 88, with UDP being the default for smaller tickets and TCP used when tickets exceed the UDP size limit.

    The Kerberos Authentication Process

    Phase 1: AS Exchange (Authentication)

  • The client sends an **AS-REQ** to the KDC containing the user's identity (username)
  • The KDC looks up the user in AD and retrieves their password hash
  • The KDC responds with an **AS-REP** containing two parts: the TGT encrypted with the KRBTGT hash, and a session key encrypted with the user's password hash
  • The client decrypts the session key using its password hash
  • The client stores the TGT and session key in its Kerberos ticket cache

    • Phase 2: TGS Exchange (Service Ticket Request)

  • The client sends a **TGS-REQ** to the KDC containing the TGT and the SPN (Service Principal Name) of the target service
  • The KDC decrypts the TGT using the KRBTGT hash and verifies the authenticator
  • The KDC looks up the service account and retrieves its NTLM hash
  • The KDC responds with a **TGS-REP** containing a service ticket encrypted with the service account's NTLM hash and a new session key

    • Phase 3: AP Exchange (Service Access)

  • The client sends the service ticket to the target service
  • The service decrypts the ticket using its own NTLM hash
  • The service verifies the authenticator and grants access

    • Kerberos Security Weaknesses

    Kerberoasting

    Kerberoasting targets service accounts. Any domain user can request a service ticket for any service. The ticket is encrypted with the service account's NTLM hash, allowing offline cracking.

    # Enumerate SPNs and request tickets
impacket-GetUserSPNs -dc-ip 192.168.1.10 corp.local/user

# Crack with hashcat
hashcat -m 13100 kerberos.txt /usr/share/wordlists/rockyou.txt

    AS-REP Roasting

    Targets users without Kerberos pre-authentication. The KDC returns a TGT encrypted with the user's password hash without requiring proof of knowledge.

    impacket-GetNPUsers -dc-ip 192.168.1.10 corp.local/ -usersfile users.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

    Golden and Silver Tickets

    Golden tickets forge TGTs using the KRBTGT hash. Silver tickets forge service tickets using a service account's hash. Both provide persistent access without KDC interaction.

    Common Mistakes

  • Using weak passwords for service accounts
  • Disabling pre-authentication without understanding the implications
  • Failing to rotate KRBTGT password after a breach
  • Giving service accounts excessive privileges

    • Best Practices

  • Use **Group Managed Service Accounts (gMSAs)** for automatic password rotation
  • Set service account passwords to 25+ random characters
  • Monitor **Event ID 4769** for unusual service ticket requests
  • Rotate **KRBTGT password** twice after any suspected compromise
  • Disable **RC4 encryption** in favor of AES

    • Related Tools

  • **Mimikatz** — Credential extraction and ticket manipulation
  • **Rubeus** — Kerberos interaction toolkit
  • **Impacket** — Python tools for Kerberos interaction
  • **Kerbrute** — Kerberos pre-authentication brute force
  • **hashcat** — GPU-accelerated password cracking

    • Related Articles

  • Active Directory Fundamentals: Windows Network Domains
  • Golden Ticket Attacks: Kerberos Ticket Forging Explained
  • Silver Ticket Attacks: Service Ticket Manipulation
  • Pass-the-Hash: Understanding NTLM Authentication Attacks
  • Domain Enumeration: Active Directory Reconnaissance Techniques

    • Summary

    Kerberos is the foundation of authentication in modern Windows networks. Its ticket-based architecture eliminates password transmission but introduces attack vectors including Kerberoasting, AS-REP roasting, golden tickets, and silver tickets. Understanding Kerberos internals is essential for both defending Active Directory and conducting authorized penetration tests.

    Related SMB Tool Recommendations

  • [SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares
  • [Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies
  • [Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output
  • [NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing
  • [CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks
  • [NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

    • Knowledge Check

  • What are the two types of tickets in Kerberos?
  • What is the KRBTGT account and why is its hash so sensitive?
  • How does a Kerberoasting attack work?
  • What condition must exist for AS-REP roasting to succeed?
  • What is the difference between a golden ticket and a silver ticket?

    • Frequently Asked Questions

    What is Kerberos authentication?

    Kerberos is a network authentication protocol that uses symmetric key cryptography and tickets to authenticate users without transmitting passwords. It is the default authentication protocol in modern [Active Directory](/articles/active-directory-fundamentals) environments, using a trusted third-party (the KDC) to issue encrypted tickets.

    What are Kerberos tickets?

    Kerberos uses two ticket types: Ticket Granting Tickets (TGTs) prove identity and allow requesting service access, while Service Tickets (TGSs) grant access to specific services. TGTs are encrypted with the KRBTGT hash; service tickets are encrypted with the target service account's hash.

    What is the KRBTGT account?

    The KRBTGT account is a special disabled user account whose password hash encrypts all TGTs in a domain. It is the most sensitive key in AD — compromising it allows forging golden tickets for persistent Domain Admin access. The KRBTGT password must be rotated twice after any breach.

    How does Kerberoasting work?

    Any domain user can request a service ticket for any service with an SPN. The ticket is encrypted with the service account's NTLM hash, allowing offline cracking with [Hashcat](/articles/hashcat-guide) mode 13100. Strong service account passwords and Group Managed Service Accounts (gMSAs) prevent Kerberoasting.

    What is AS-REP roasting?

    AS-REP roasting targets users without Kerberos pre-authentication. The KDC returns a TGT encrypted with the user's password hash without requiring proof of knowledge. Use Impacket's `GetNPUsers.py` to extract these hashes, then crack them offline with Hashcat mode 18200.

    What is the difference between a golden ticket and a silver ticket?

    A golden ticket forges TGTs using the KRBTGT hash, granting unrestricted Domain Admin access across the entire domain. A silver ticket forges service tickets using a service account's hash, granting access to only that specific service. Golden tickets are more powerful but require the KRBTGT hash.

    What port does Kerberos use?

    Kerberos uses UDP/TCP port 88 for ticket exchange. The KDC listens on both, with UDP for smaller tickets and TCP for larger ones. Monitoring port 88 traffic can reveal Kerberoasting and AS-REP roasting attempts through unusual service ticket request patterns.

    How does Kerberos prevent password transmission?

    During authentication, the client encrypts a timestamp with its password hash and sends it to the KDC. The KDC decrypts it to verify identity, then issues a TGT encrypted with the KRBTGT hash. At no point is the actual password transmitted over the network.

    Why is disabling pre-authentication dangerous?

    Disabling Kerberos pre-authentication for a user makes them vulnerable to AS-REP roasting. Without pre-authentication, the KDC issues a TGT encrypted with the user's password hash without requiring proof of knowledge, giving attackers an offline cracking opportunity.

    How do I detect Kerberos attacks?

    Monitor Windows Event ID 4769 for unusual service ticket requests (Kerberoasting) and Event ID 4768 for pre-authentication failures (AS-REP roasting). Large volumes of TGS requests from a single account or tickets encrypted with RC4 (weaker encryption) are strong indicators.