> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/kerberos-enumeration/kerberos-authentication.md).

# Kerberos Authentication

Kerberos is a network authentication protocol used in Active Directory environments to verify the identity of users and services. It uses tickets to allow nodes to prove their identity in a secure manner over an insecure network.

### **How Kerberos Authentication Works**

Kerberos operates based on **tickets** to allow nodes communicating over a non-secure network to prove their identity securely. The process involves three main components:

1. **Client** – The user or service requesting access.
2. **Authentication Server (AS)** – Verifies the client's identity and issues a Ticket Granting Ticket (TGT).
3. **Ticket Granting Server (TGS)** – Provides service tickets after verifying the TGT.
4. **Service Server** – The resource the client wants to access (e.g., a file server, application).

#### **Step-by-Step Kerberos Authentication Process**

1. **Authentication Request (AS Exchange)**
   * The client sends a request to the **Authentication Server (AS)** with their username.
   * The AS checks if the user exists in the Kerberos database.
   * If valid, the AS generates:
     * A **session key** (for communication between client and TGS).
     * A **Ticket Granting Ticket (TGT)** encrypted with the TGS’s secret key.
   * The AS sends these back to the client, encrypted with the client’s password-derived key.
2. **Ticket Granting Ticket (TGT) Request (TGS Exchange)**
   * The client decrypts the AS response (using their password hash) to get the **TGT** and **session key**.
   * The client sends a request to the **Ticket Granting Server (TGS)** with:
     * The **TGT** (still encrypted with TGS’s key).
     * An **authenticator** (timestamp encrypted with the session key).
   * The TGS decrypts the TGT, verifies the authenticator, and issues a **service ticket** for the requested service.
3. **Service Request (Client/Server Exchange)**
   * The client sends the **service ticket** (encrypted with the service’s secret key) and a new **authenticator** to the **Service Server**.
   * The server decrypts the ticket, verifies the authenticator, and grants access.

### **Common Kerberos Attacks**

* Kerberoasting
* AS-REP Reasting
* Pass-the-Ticket (PtT) – Stealing Kerberos tickets to impersonate users.
* Golden Ticket
* Silver Ticket

### Resource

{% embed url="<https://kylemistele.medium.com/impacket-deep-dives-vol-2-attacking-kerberos-922e8cdd472a>" %}