Shadow Credentials is a common name for an Active Directory attack path involving unauthorized key credential material on a user or computer object. Shadow Credentials exists when an attacker can add a key credential to an Active Directory object and later use that credential to authenticate as that object. This matters because the attacker may […]
Shadow Credentials in Active Directory Read Post »
Resource-Based Constrained Delegation, often shortened to RBCD, is a Kerberos delegation model in Active Directory where the target resource controls which accounts are allowed to delegate to it. It was introduced to make delegation easier to manage across service boundaries, but it can create serious security risk when permissions on computer objects are weak or
Resource-Based Constrained Delegation in Active Directory Read Post »
Constrained delegation is a Kerberos delegation setting in Active Directory that allows a service to impersonate users only to specific downstream services. It was introduced as a safer alternative to unconstrained delegation because it limits where delegated authentication can be used. The simplest way to think about constrained delegation is: A service can act on
Constrained Delegation in Active Directory Read Post »
Unconstrained delegation is a legacy Kerberos delegation setting in Active Directory that allows a trusted service to impersonate users to other services. It was designed to support multi-tier applications, but it can create serious security risk if the trusted server or service account is compromised. A server trusted for unconstrained delegation may be able to
Unconstrained Delegation in Active Directory Read Post »
AS-REP Roasting is an Active Directory attack technique that targets user accounts configured with Kerberos preauthentication disabled. When preauthentication is not required, an attacker can request Kerberos authentication data for the account and attempt to crack it offline to recover the user’s password. AS-REP Roasting is dangerous because it does not require administrative privileges. In
AS-REP Roasting in Active Directory Read Post »
Kerberoasting is an Active Directory attack technique where an authenticated domain user requests Kerberos service tickets for accounts that have Service Principal Names, then attempts to crack those tickets offline to recover the service account passwords. Kerberoasting is dangerous because it does not require administrative privileges. In many environments, any valid domain user can request
Kerberoasting in Active Directory Read Post »