Authentication: Kerberos and NTLM
You authenticate to CORP.LAB from Kali with Kerberos: get a ticket from the ticket-granting server (KDC), read the ticket and its flags, connect to a share with Kerberos and to the same share with NTLM and see the difference. You inspect the encryption type of service tickets, find the accounts exposed to Kerberoasting and AS-REP roasting with a defender’s eye and report them.
Level 201 · 50 min
CORP’s internal audit continues. This time the IT manager asks: "How do our users sign in, and is there a weak link in those sign-ins?" You again hold a written authorisation and the read-only denetci account (password Denetim.2026).
Two authentication methods live side by side in a Windows domain. Kerberos is a ticket system: at an amusement park you get a wristband at the entrance (TGT), then for each ride you show the wristband and get a separate token (service ticket); you don’t repeat your password at every gate. NTLM is the older method: on every connection the server asks a question and you give an answer derived from your password.
Attackers love weak settings in both systems. In this lesson you won’t attack anything; you will find the same weaknesses with a defender’s tools and learn how they are detected and closed.
Note: the domain controller takes about 20 seconds to get ready after the lab starts. If the first commands get no answer, wait a little and try again. In the first steps I give you the commands; the help fades as you go on.
What you will do in this lesson
- Tell Kerberos about the domain
- Get the wristband: kinit and klist
- Look inside the ticket: klist -e -f
- Connect to a service with Kerberos
- Connect to the same share with NTLM
- How service tickets are encrypted: kvno
- Find the user accounts that have an SPN
- Accounts without pre-authentication
- Report the Kerberos findings
- Delete the tickets when you are done
- Short quiz
Skills you will earn
- Configuring a Kerberos client for a domain (krb5.conf, KRB5_CONFIG)
- Getting a TGT and listing tickets (kinit, klist)
- Reading ticket flags and encryption types (klist -e -f)
- Connecting to a service with Kerberos and seeing the service ticket
- Telling NTLM from Kerberos and knowing its detection events (4776)
- Spotting weak encryption (RC4) in a service ticket
- Auditing accounts with SPNs exposed to Kerberoasting
- Finding accounts without Kerberos pre-authentication
- Reporting Kerberos findings with recommendations
- Deleting Kerberos tickets when done (kdestroy)
← Domain controllers and DNS: SRV records · Active Directory security: auditing and hardening · Querying the directory with LDAP: filters and attributes →
Start for free