> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/kerberos-primer.md).

# Kerberos Primer

Kerberos handles authentication in Active Directory.

It proves who a user or service is. It does not decide what that identity can access after login.

### Core objects

#### Users, computers, and services

User accounts represent people or service identities.

Computer accounts usually end with `$`. They are still security principals and can own services, tickets, and permissions.

Services are identified by SPNs, or Service Principal Names. If an attacker controls an account with a useful SPN, that account often becomes interesting fast.

#### TGT, TGS, and PAC

A **TGT** lets a principal ask the KDC for service tickets.

A **TGS** is the service ticket presented to a specific service.

The **PAC** carries identity and privilege data inside the ticket.

#### The KDC

The Key Distribution Center runs on the domain controller.

It issues TGTs and TGSs. In practice, that makes it the source of Kerberos trust.

### How the flow works

The common flow is short:

1. A user authenticates and receives a TGT.
2. The user presents that TGT to request a TGS for a service.
3. The user presents the TGS to the service.

That model matters because most Kerberos abuse either steals one of those tickets or convinces the KDC to mint one on someone else's behalf.

### Key material

Kerberos depends on several keys:

* The `krbtgt` key signs trust for the domain.
* User keys derive from user credentials.
* Service keys derive from the service account or computer account.
* Session keys protect ticket exchanges.

If an attacker gets the `krbtgt` material, they can forge domain trust. If they get a service key, they may be able to forge or abuse service access.

### Terms that matter in practice

#### SPN

An SPN maps a service instance to an account.

That mapping is why service accounts become targets for kerberoasting, delegation abuse, and ticket substitution.

#### Forwardable tickets

A forwardable ticket can be reused in delegation flows.

That flag often decides whether constrained delegation succeeds.

#### Pre-authentication

Kerberos pre-authentication forces a user to prove knowledge of the password before the KDC returns material.

If pre-auth is disabled, AS-REP roasting becomes possible.

### Common attack classes

#### Pass-the-Hash

If an attacker has a valid NTLM hash, they may authenticate as that principal without the plaintext password.

#### Pass-the-Ticket

If an attacker steals a usable ticket and session material, they may reuse that ticket directly.

#### Kerberoasting

Any authenticated domain user can request service tickets for SPN-bearing accounts.

Those tickets can often be cracked offline to recover the service account secret.

#### AS-REP roasting

If `DONT_REQ_PREAUTH` is set on a user, the KDC may return crackable material without normal pre-authentication.

#### Golden and silver tickets

A **golden ticket** is a forged TGT built from `krbtgt` trust.

A **silver ticket** is a forged TGS built from a service key. It is narrower, but still powerful.

### Why this matters for the rest of the section

Delegation abuse extends normal Kerberos behavior.

AD CS abuse often ends by requesting Kerberos tickets with a certificate-backed identity.

If you understand TGTs, TGSs, SPNs, and forwardable tickets, the rest of the section becomes much easier to follow.