Auth Abuse Named
Kerberoasting and Pass-the-Hash named as concepts — defender focus and $LAB_AD literacy, not stranger-domain cookbooks.
Visual · t19_auth_abuse_named
Auth abuse = misuse of Kerberos/NTLM mechanisms. Named only on $LAB_AD. Original Cyberlium.
Know what Kerberoast and PtH mean so you can detect them — not so you can run them on a domain you do not own.
Authentication abuse concepts defenders must know: Kerberoasting (requesting service tickets for SPN accounts to offline crack weak passwords — T1558.003), Pass-the-Hash (reusing NTLM hashes without plaintext — T1550.002), Pass-the-Ticket, AS-REP roasting (weak preauth), and password spraying (controlled rate — refused outside RoE). Cyberlium names these for blue-team literacy and authorized $LAB_AD exercises per brief — NOT full attack cookbooks for stranger domains, NOT spraying real university or employer AD, NOT sharing cracked hashes publicly. Defenders mitigate with strong service account passwords, AES-only Kerberos where possible, LAPS, tiered admin, and detection on ticket anomalies.
1. Kerberoasting (concept)
Attacker requests TGS for SPN-linked account; offline crack if password weak — service accounts are high risk.
Defender: long random service passwords, managed service accounts, monitor anomalous TGS requests.
Command guide
Try these commands — Kerberoasting (concept)
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: curl, grep. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); AD notes. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Pass-the-Hash (concept)
NTLM hash reuse to authenticate without plaintext — lateral movement category on lab only under RoE.
Defender: Credential Guard, restrict NTLM, Protected Users group, monitor unusual logon types.
3. Hard refusal
No Kerberoast/PtH/spray against stranger domains, production employer AD, or internet-exposed DCs.
Lab exercises use disposable $LAB_AD accounts with known-weak passwords per brief — then revert snapshot.
4. What you ship: auth abuse literacy card
Kerberoast + PtH one-liners + ATT&CK IDs + three defender mitigations + NEVER stranger AD.
5. What you record before the next lesson
Auth abuse literacy card path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Kerberoast a production SaaS company's AD because a blog post showed commands.
- Right: Name auth abuse concepts and defenses. Next: AD Lab.
Mission: auth abuse literacy card
1) Define Kerberoasting and Pass-the-Hash in one line each. 2) Name ATT&CK IDs if brief provides. 3) List three defender mitigations. 4) Write NEVER stranger-domain auth abuse.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Protected Users group — what it blocks?”
APPLY: Kerberoasting targets:
APPLY: True or False: Pass-the-Hash on stranger AD is course lab.
APPLY: Defenders mitigate PtH with: