Byte JMP

#kerberos

3 posts

Kerberoasting: A Complete Guide from Theory to Exploitation in Active Directory
◆

Kerberoasting: A Complete Guide from Theory to Exploitation in Active Directory

How any authenticated domain user can extract service account password hashes from Active Directory using legitimate Kerberos functionality, and crack them offline. Theory grounded in RFC 4120, lab setup, multiple exploitation paths, and cracking strategies.

—16 min read
AS-REP Roasting: Exploiting Accounts Without Kerberos Pre-Authentication
◆

AS-REP Roasting: Exploiting Accounts Without Kerberos Pre-Authentication

How disabling Kerberos pre-authentication hands attackers an offline password crack with no credentials required. Lab setup, enumeration, exploitation, and offline cracking.

—8 min read
Fluffy: Shadow Credentials and ADCS ESC16
◆

Fluffy: Shadow Credentials and ADCS ESC16

Active Directory chain — CVE-2025-24071 hash leak, Shadow Credentials via GenericWrite, and ADCS ESC16 UPN hijack to Domain Admin.

—17 min read