Tagged: Kerberos
9 posts · browse all tags
-
BloodHound Deep Dive Part 5: Kerberoasting and AS-REP Roasting Through the Graph
BloodHound's real hasspn and dontreqpreauth properties point at the exact same two accounts Impacket Deep Dive found by hand, and a clean shortestPath query with no results shows why being roastable isn't the same as being worth roasting.
-
CVE-2026-56155 and CVE-2026-20833: Why Patch Tuesday Keeps Rediscovering the Impacket Series
July 2026's record Patch Tuesday shipped a Kerberoasting CVE and an AD FS key-theft zero-day that map almost exactly onto techniques from the Impacket Deep Dive series. Real transcripts from that series, held up against four CVEs, to show why the same trust-chain weaknesses keep resurfacing.
-
Password Cracking and Wordlist Engineering Part 1: The Hash Landscape and Why Offline Cracking Is a Different Game
Every post in the Impacket series ended with a hash. This one starts there: what NTLM, Kerberoast, and AS-REP hashes actually are, why offline cracking is a fundamentally different problem from an online login attempt, and the hash landscape the rest of this series works through.
-
Password Cracking and Wordlist Engineering Part 7: Cracking CONTOSO.LOCAL End to End
Two hashes the Impacket series pulled off CONTOSO.LOCAL and stated the plaintext for without explaining how. This post runs the actual pipeline — baseline wordlist, OSINT-built vocabulary, custom rules, and a combinator-plus-hybrid chain — that gets from ciphertext to both passwords.
-
Impacket Deep Dive Part 10: Defense in Depth and Detection
Nine posts of offense, consolidated into one defensive reference: every hardening control and detection signature from this series, an event ID cheat sheet, and where network-layer segmentation fits when the domain itself is already compromised.
-
Impacket Deep Dive Part 3: AS-REP Roasting with GetNPUsers.py
One unset checkbox — Kerberos pre-authentication — turns a domain account into a crackable hash that any authenticated, or sometimes any unauthenticated, client can request. Part 3: GetNPUsers.py, what AS-REP roasting actually exploits, and how to close it.
-
Impacket Deep Dive Part 4: Kerberoasting with GetUserSPNs
Any authenticated domain user can request a service ticket for any account with a registered SPN, and that ticket is encrypted with the service account's own password hash. Part 4: GetUserSPNs, why pre-auth doesn't save you here, and the gMSA fix.
-
Impacket Deep Dive Part 8: Forging Tickets with ticketer.py
With the krbtgt hash from Part 7 in hand, an attacker doesn't need any account's password ever again. ticketer.py forges Kerberos tickets outright — Golden Tickets for full-domain impersonation, Silver Tickets for a single quiet service, both bypassing the domain controller entirely.
-
Impacket Deep Dive Part 9: The Full Chain, Foothold to Domain Admin
Eight posts, eight tools, one domain. Part 9 runs CONTOSO.LOCAL's compromise start to finish, in the order a real intrusion actually uses these techniques — one phished workstation to a persistent, forged Domain Admin ticket.