ADKERB-002: Kerberoasting con cifrado débil
- Plataforma
- Active Directory
- Categoría
- AD Kerberos Security
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las cuentas de usuario con SPN configuradas para usar cifrado RC4 o DES son considerablemente más fáciles de descifrar mediante Kerberoasting que las que usan AES. Los tickets RC4 (ARCFOUR-HMAC-MD5) pueden romperse órdenes de magnitud más rápido que los AES en hardware GPU moderno. Las cuentas configuradas explícitamente con tipos de cifrado débiles, o sin claves AES, son los objetivos de Kerberoasting de mayor prioridad.
Por qué importa
Kerberoasting is a post-authentication attack that requires only a valid domain user. Any authenticated principal can request a TGS for any registered SPN, and the resulting ticket is encrypted with a key derived from the target service account password. When that key is RC4-HMAC-MD5, the derivation is a single unsalted NT hash (MD4 of the UTF-16LE password), which hashcat mode 13100 cracks at hundreds of millions to billions of guesses per second on commodity GPUs. AES256 tickets (hashcat mode 19700) are roughly four orders of magnitude slower per guess and use a per-realm salt, making dictionary and rule-based attacks impractical for passwords of reasonable length and entropy. Service accounts are uniquely high-value because they typically have non-expiring passwords, broad delegation, membership in privileged groups (Domain Admins, Exchange Trusted Subsystem, SQL service groups), and are rarely rotated. A single RC4-roastable Tier 0 service account compromise yields silver tickets and frequently a path to Domain Admin. Even after enabling AES in the domain via msDS-SupportedEncryptionTypes, accounts that have not had their password rotated since the change have no AES keys in the KDS database, and the KDC will fall back to RC4 regardless of what the attribute advertises.
Ruta de ataque
Step 1: Foothold. The attacker holds any authenticated domain user context, obtained via phishing, password spray, or compromise of a low-tier workstation. No special privileges are required. Step 2: SPN enumeration. The attacker runs GetUserSPNs.py (Impacket), Rubeus kerberoast /stats, or PowerView Get-DomainUser -SPN to list every user account with a populated servicePrincipalName. Guerrilla output, BloodHound (Kerberoastable edge), and ldapsearch all surface the same set. Step 3: Target selection. The attacker filters for accounts that will return RC4 tickets. Rubeus kerberoast /rc4opsec restricts requests to accounts whose msDS-SupportedEncryptionTypes does not include AES, avoiding noisy AES requests that would otherwise be downgraded. Without /rc4opsec, the attacker explicitly requests etype 23 in the TGS-REQ and the KDC will issue an RC4 ticket if the account has an RC4 key in the KDS, which is the default for any account that has not been rotated since AES was enabled. Step 4: Ticket request. The attacker calls TGS-REQ for each target SPN. The KDC, which does not require the requester to actually use the service, returns a TGS-REP containing the service ticket encrypted with the service account password-derived key. Rubeus and Impacket both extract the encrypted portion and format it as a hashcat-compatible string ($krb5tgs$23$* for RC4, $krb5tgs$18$* for AES256). Step 5: Offline cracking. The attacker runs hashcat -m 13100 (RC4) against a wordlist with rules. Cracking rates on a single RTX 4090 exceed 6 billion guesses per second for RC4 Kerberos hashes, sufficient to brute-force any password up to roughly 9 mixed-case alphanumeric characters and to defeat virtually any wordlist-and-rules combination for service account passwords under 14 characters. Step 6: Credential use. The cleartext password is used to authenticate as the service account, request a TGT, and pivot via group memberships (often Domain Admins, Backup Operators, or Tier 0 application rights) or via constrained or unconstrained delegation configured on the account. Recovered service account credentials also unlock silver ticket forgery against the affected service for long-term persistence.
Cómo lo evalúa Guerrilla
Guerrilla connects to the closest domain controller via LDAP over port 389 (or 636 when LDAPS is required by policy) and issues a paged search rooted at the default naming context with filter (&(samAccountType=805306368)(servicePrincipalName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) and attribute set msDS-SupportedEncryptionTypes, userAccountControl, servicePrincipalName, pwdLastSet, lastLogonTimestamp, memberOf, adminCount. For each user it computes an effective encryption flag by combining msDS-SupportedEncryptionTypes with the USE_DES_KEY_ONLY bit in userAccountControl. A finding is raised when the effective flag is missing AES128 (0x08) and AES256 (0x10), when the attribute is null or zero, or when the account is a member of a Tier 0 group (Domain Admins, Enterprise Admins, Schema Admins, BUILTIN\Administrators, krbtgt parents) regardless of encryption type because the blast radius justifies a finding on its own. The check also surfaces pwdLastSet relative to the domain functional level upgrade or the documented date AES was enabled, so the operator can identify accounts that advertise AES but have no AES key material because the password predates AES support. Output is enriched with the SPN list and member-of groups to support triage.
Valor recomendado
Todas las cuentas con SPN admiten cifrado AES256. Ninguna cuenta restringida a los tipos de cifrado RC4 o DES. msDS-SupportedEncryptionTypes incluye los indicadores AES en todas las cuentas de servicio.
Remediación
Consulta las cuentas de usuario con SPN y revisa su atributo msDS-SupportedEncryptionTypes. Las cuentas con valor 0 (sin establecer) usan RC4 por defecto. Las cuentas con solo los indicadores RC4 (0x4) o DES (0x1, 0x2, 0x3) son vulnerables. Rota las contraseñas de todas las cuentas afectadas después de habilitar AES en el dominio para generar claves AES. Establece msDS-SupportedEncryptionTypes con los indicadores AES128 (0x8) y AES256 (0x10).
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1), SC-12
- ANSSI
- R36, R37
- CIS AD Benchmark
- 7.1.2
- MITRE ATT&CK
- T1558.003