Picus Security Details Kerberoasting Attack Method
Cybersecurity firm Picus Security has detailed the Kerberoasting attack, a post-exploitation technique targeting Active Directory environments. The method can lead to credential theft and network compromise.
Picus Security, a cybersecurity firm, has published an explanation of the Kerberoasting attack, a technique that exploits weaknesses in the Kerberos authentication protocol commonly used in Active Directory environments.
The attack leverages the ability of any authenticated domain user to request service tickets for accounts associated with a Service Principal Name (SPN). These tickets are encrypted using the service account's password hash. Attackers can then perform offline brute-force attacks to crack the hash and obtain the service account's plaintext credentials.
While machine accounts typically have automatically managed, complex passwords, user accounts with SPNs may not enforce the same password policies. This makes them a more accessible target for attackers. Successful cracking of these passwords can allow attackers to escalate privileges, move laterally across a network, steal sensitive data, and potentially compromise the entire infrastructure.
Picus Security emphasizes understanding the Kerberos authentication flow, which involves user authentication, requesting a service ticket via an SPN, and finally accessing the service. The Kerberoasting attack specifically targets the service ticket, aiming to decrypt it using the service account's password hash.
The firm also provides resources to help organizations identify potential attack paths within their networks, aiming to enhance defenses against such threats.