Kerberos Explained: Tickets, the KDC and Kerberoasting for Security+

Kerberos is the authentication protocol at the heart of Active Directory, and it is the reason you type your password once at login and then reach file shares, printers, and applications all day without typing it again. It is named after the three-headed dog of Greek myth, which is a fair description of its three-party design.

Kerberos proves who you are without ever sending your password across the network — not even encrypted.

That is the central idea, and it is what separates Kerberos from the protocols it replaced. Older schemes transmitted passwords or password hashes that could be captured and replayed. Kerberos instead uses your password locally, as a key, to decrypt something only you should be able to decrypt.

The Three Parties

The client — the user or service requesting access.

The Key Distribution Center (KDC) — the trusted third party, which in Active Directory is every domain controller. It has two functions:

  • The Authentication Service (AS), which verifies identity and issues the ticket-granting ticket.
  • The Ticket Granting Service (TGS), which issues service tickets to clients that already hold a valid TGT.

The service — the resource being accessed: a file server, a SQL instance, a web application.

How the Exchange Works

  1. AS-REQ. The client asks the Authentication Service for a ticket-granting ticket, sending a timestamp encrypted with a key derived from the user's password.
  2. AS-REP. The KDC decrypts that timestamp using its own copy of the user's key. If it decrypts to a sensible, recent time, the user must know the password. The KDC returns a ticket-granting ticket (TGT), encrypted with the KDC's own secret key — the krbtgt account key — so the client cannot read or alter it.
  3. TGS-REQ. To reach a specific service, the client presents the TGT to the Ticket Granting Service and names the service it wants.
  4. TGS-REP. The KDC issues a service ticket encrypted with that service account's key.
  5. AP-REQ. The client presents the service ticket to the service, which decrypts it with its own key and grants access.

Note what never happened: the password never crossed the network, and the service never contacted the KDC. That second point is why Kerberos scales — the domain controller is not a bottleneck on every file access.

Why Time Matters So Much

Kerberos uses timestamps to defeat replay attacks, and it enforces a tolerance — five minutes by default in Active Directory. If a client's clock drifts beyond that window, authentication fails outright.

This is the single most practical Kerberos fact, and it is heavily tested. If a domain-joined machine suddenly cannot authenticate, check the clock first. It is also why NTP is treated as security infrastructure rather than a convenience, and why a broken time source can take down an entire domain.

Tickets and Lifetimes

A TGT is typically valid for 10 hours and renewable for 7 days, which is why the ticket cache expiring mid-afternoon is a recognizable support pattern. Tickets can be inspected on Windows with klist, and purged with klist purge — which is frequently the fix when stale tickets cause access failures after a permissions change.

Attacks Worth Knowing

Kerberos is strong, but its design creates specific, well-known attacks that appear on security exams.

  • Kerberoasting. Any authenticated user can request a service ticket for any service account. That ticket is encrypted with the service account's password-derived key, so an attacker can request it, take it offline, and brute-force the password at leisure. The defense is long, random passwords on service accounts and, better, group Managed Service Accounts.
  • AS-REP roasting. Accounts with pre-authentication disabled will hand out an AS-REP encrypted with the user's key to anyone who asks, enabling the same offline cracking. The defense is to require pre-authentication everywhere.
  • Golden Ticket. An attacker who steals the krbtgt account hash can forge TGTs for any user, including domain admins, with any validity period. This is effectively total, persistent domain compromise, and recovering requires resetting the krbtgt password twice.
  • Silver Ticket. Forging a service ticket using a single service account's hash. Narrower than a Golden Ticket, and quieter, because the KDC is never involved.
  • Pass-the-ticket. Stealing a valid ticket from memory on a compromised host and reusing it elsewhere.

Security+ (SY0-701) Exam Tips

  • Kerberos is the default authentication protocol for Active Directory and uses UDP and TCP port 88.
  • It provides single sign-on and mutual authentication — the service proves itself to the client as well.
  • The password is never transmitted. This is the most commonly tested property.
  • Know the components: KDC, Authentication Service, Ticket Granting Service, TGT, service ticket.
  • Time synchronization is mandatory, with a five-minute default tolerance. Clock skew is the classic failure.
  • It is a symmetric-key protocol using a trusted third party — not public key.
  • Compare it with LDAP (a directory protocol, not authentication), RADIUS and TACACS+ (network access AAA), and SAML (web federation across organizations).

PenTest+ and CySA+ Angles

PenTest+ (PT0-003) expects the attack side: enumerating service principal names, running Kerberoasting and AS-REP roasting, pass-the-ticket, and the role of Golden and Silver tickets in establishing persistence.

CySA+ (CS0-004) expects detection: Windows event IDs 4768 and 4769 for ticket requests, spotting unusual encryption types such as RC4 where AES is standard, tickets with implausible lifetimes, and bursts of service ticket requests from a single account.

Key Takeaways

  • Kerberos authenticates without transmitting the password, using a trusted third party and symmetric keys.
  • Three parties: client, KDC (with AS and TGS), and the service.
  • Get a TGT once, then exchange it for service tickets — that is what delivers single sign-on.
  • Port 88, and clocks must be within five minutes. Clock skew is the classic break.
  • Kerberoasting targets service account passwords; long random passwords are the defense.
  • A Golden Ticket means the krbtgt hash is stolen and the domain is fully compromised.

Comments

Post a Comment