Lion Cipher Lab

Understand Kerberos and detect Kerberoasting in your AD lab

• SOC Analyst / Blue Team
• Advanced
• ~90 min
• Free · no account required

Why it matters

Kerberos is how almost every Windows network on earth proves who you are -- and Kerberoasting is one of the most common ways attackers turn a single ordinary user account into the password of a powerful service account, quietly and without setting off a single failed-logon alarm. It shows up constantly in real intrusions precisely because it abuses Kerberos working exactly as designed: any authenticated user is allowed to ask for a service ticket, and that ticket is encrypted with the service account's password, so an attacker can walk away and crack it offline at leisure. For a defender that…

What you'll learn

• explaining what Kerberos, the KDC, a realm, and a ticket are in plain language
• walking the Kerberos authentication flow message by message (AS-REQ/AS-REP, TGS-REQ/TGS-REP, AP-REQ)
• defining a Service Principal Name (SPN) and a service account, and creating one in your own lab
• explaining exactly why Kerberoasting works and why the cracking happens offline
• requesting a service ticket against your OWN lab with Rubeus or impacket's GetUserSPNs to see the roast
• recognising the Kerberoasting signature in Windows Security Event ID 4769 (volume, and RC4 / encryption type 0x17)
• enabling Kerberos service-ticket auditing and querying 4769 with Get-WinEvent
• remediating with a long random service-account password, AES-only encryption, or a group Managed Service Account (gMSA)

Steps in this lab

1. What Kerberos actually is, and the cast of characters
2. The two kinds of ticket: a TGT and a TGS
3. Walk the whole flow, one message at a time
4. What an SPN and a service account are
5. What Kerberoasting is, and why the cracking is offline
6. Set the stage: create a service account with an SPN in your lab
7. Turn on the logging BEFORE you attack
8. Perform the roast against your OWN lab -- Rubeus or impacket
9. Crack it offline -- to prove why weak passwords are the whole game
10. Detect it: hunt the roast in Event ID 4769
11. Remediate: kill the offline crack with a password it cannot break
12. What you actually learned, and the one habit to keep

Open the full interactive lab →