SKILL: Kerberos Attack Playbook, Expert AD Attack Guide

AI LOAD INSTRUCTION: Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs.

0. RELATED ROUTING

Before going deep, consider loading:

• active-directory-acl-abuse for ACL-based AD attacks often chained with Kerberos
• active-directory-certificate-services for ADCS-based persistence (golden certificate)
• ntlm-relay-coercion for NTLM relay attacks that complement Kerberos abuse
• windows-lateral-movement after obtaining tickets for lateral movement

Advanced Reference

Also load KERBEROS_ATTACK_CHAINS.md when you need:

• Multi-step attack chains combining Kerberos with ACL abuse, ADCS, and relay
• End-to-end scenarios from foothold to domain admin
• Chained delegation attack flows

---

1. KERBEROS AUTHENTICATION PRIMER

Client              KDC (DC)              Service
  │                   │                     │
  │── AS-REQ ────────→│                     │  (1) Request TGT with user creds
  │←─ AS-REP ─────────│                     │  (2) Receive TGT (encrypted with krbtgt hash)
  │                   │                     │
  │── TGS-REQ ───────→│                     │  (3) Present TGT, request service ticket
  │←─ TGS-REP ────────│                     │  (4) Receive TGS (encrypted with service hash)
  │                   │                     │
  │── AP-REQ ─────────────────────────────→│  (5) Present TGS to service
  │←─ AP-REP ──────────────────────────────│  (6) Mutual auth (optional)

---

2. AS-REP ROASTING