Active › Module 3 › Lesson 2
TGS TGT Named
TGT grants further tickets; TGS proves access to a service — name the exchange on $LAB_AD; defenders watch anomalous TGS patterns.
Visual · t25_tgs_tgt_named
TGT/TGS literacy. $LAB_AD only. Original Cyberlium.
Opening
Logon starts with TGT; service access uses TGS — know the two-step dance before naming Kerberoast.
AS-REQ/AS-REP: user authenticates to KDC, receives TGT (encrypted with krbtgt hash). TGS-REQ/TGS-REP: client presents TGT, requests ticket for service SPN, receives TGS for that service. Service validates TGS without seeing user password. Cyberlium diagrams TGT→TGS flow on YOUR $LAB_AD — not capturing tickets from stranger sessions. Next: SPN Named.
1. TGT exchange (named)
Initial authentication yields TGT bound to user and domain krbtgt account. TGT is reusable until expiry for requesting service tickets — stolen TGT enables Pass-the-Ticket class (named later with mitigations).
On $LAB_AD, sketch AS-REQ → AS-REP → TGT in notes — no wire capture of neighbor traffic.
Command guide
Try these commands — TGT exchange (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
TGT/TGS explained — https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview (TGT vs service ticket) MITRE T1558.003 Kerberoasting — https://attack.mitre.org/techniques/T1558/003/ (named — no roast commands) CISA AD security — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/tgt-tgs.txt" <<'EOF'
TGT: Ticket-Granting Ticket from KDC (port 88) — session key literacy
TGS: service ticket for SPN — defenders monitor 4769 anomalies
NEVER: fire kerberoast tools against stranger domains
EOFCommand — copy this
grep -E 'TGT|TGS|NEVER' "$LAB_AD/notes/tgt-tgs.txt" curl -sS https://attack.mitre.org/techniques/T1558/003/ | head -8
Primary tools to practice this lesson: curl, grep. Reference sites: TGT/TGS explained (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview); MITRE T1558.003 Kerberoasting (https://attack.mitre.org/techniques/T1558/003/); CISA AD security (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. TGS exchange (named)
Client sends TGS-REQ with TGT and desired SPN. KDC returns TGS encrypted with service account key. Kerberoast class abuses offline crack of TGS for user-owned SPNs — mitigated with strong passwords and gMSA.
Defenders alert on unusual TGS-REQ volume, RC4 downgrade patterns, and service accounts without gMSA.
3. Pass-the-Ticket literacy (preview, mitigations)
PtT reuses stolen ticket material — defender mitigations: short lifetimes, Credential Guard on endpoints, monitoring 4769 anomalies, protected users group for admins.
Ship: TGT/TGS flow diagram with AS/TGS labels and one mitigation per stage. Next: SPN Named.
4. What you ship: TGT/TGS flow for $LAB_AD
AS/TGS exchange diagram with defender notes. $LAB_AD named. NO ticket capture on strangers. chmod 600.
5. What you record before the next lesson
Date. TGT/TGS flow. $LAB_AD named. File t25-m03-l02-tgs-tgt-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capture TGS from production Wi‑Fi. Publish PtT cookbook for live tenants.
Right
Draw TGT/TGS flow with mitigations for YOUR $LAB_AD notes. Next: SPN Named.
Mission: diagram TGT/TGS flow
1) Label AS-REQ/AS-REP and TGS-REQ/TGS-REP. 2) Note what TGT vs TGS proves. 3) Add one PtT mitigation. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Link 4768 to TGT and 4769 to TGS in defender notes.
Knowledge Check
APPLY: TGT/TGS literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: TGS-REP delivers a service ticket for a requested SPN.
True or False
Knowledge Check
APPLY: Pass-the-Ticket mitigation includes:
Multiple choice