>_ PwnAtlas

Search everything Ctrl K

Search everything

47 results for «kerberoasting»

Techniques 1

Kerberoasting Active Directory · 12 machines

MITRE ATT&CK techniques 1

T1558.003 Kerberoasting MITRE ATT&CK · Credential Access

Guides 7

Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).
Best Hack The Box machines to learn Active Directory, in order 21 HTB machines to learn Active Directory from easy to insane, what each one teaches and the order to do them in to prepare for the OSCP, CPTS or CRTP.
Passwords in Active Directory: GPP (Groups.xml), LAPS and gMSA Three places where the domain itself stores passwords you can read: cpassword in Groups.xml, the LAPS local admin password and the hash of gMSA accounts.
Active Directory enumeration: users, LDAP, BloodHound and password spraying What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.
Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA.
Hash cracking with hashcat and John the Ripper: modes, rules, masks and protected files Identify a hash, pick the right hashcat mode (NTLM, NetNTLMv2, bcrypt, Kerberos), use rules and masks, and crack zip, KeePass and SSH keys with *2john.
How antivirus and EDR detect you on Windows: AMSI, ETW, hooks, AppLocker and CLM explained What Defender or an EDR checks when you run a tool (signatures, AMSI, ETW, hooks, kernel callbacks), how to tell what protects a box, and AppLocker and CLM.

Tools 4

Resources and tools 4

Machines 12

Filter these machines by difficulty and OS →

Learning paths 2

Guide sections 10

Commands 6