Read on Twitter
Honestly, all my code is basically archeology at this point.
Cracker: Hashcat
Extract: Mimikatz, Rubeus, loads of other
Request: Rubeus, Invoke-Kerberoast, loads of others
Others have done it better. Use their tools
A thread...
1/n https://twitter.com/TimMedin/status/1249790336328753154">https://twitter.com/TimMedin/...
Cracker: Hashcat
Extract: Mimikatz, Rubeus, loads of other
Request: Rubeus, Invoke-Kerberoast, loads of others
Others have done it better. Use their tools
A thread...
1/n https://twitter.com/TimMedin/status/1249790336328753154">https://twitter.com/TimMedin/...
I don& #39;t know of another tool that extracts tickets from a pcap, but there are probably a better tools than mine.
It& #39;s beautiful to see a concept I was lucky enough to land on see the development and progress we& #39;ve seen.
2/n
It& #39;s beautiful to see a concept I was lucky enough to land on see the development and progress we& #39;ve seen.
2/n
I regularly watch other people& #39;s talks on Kerberoasting. If you give a talk on it (even cursory) I try to attend or watch it later. I learn a lot on how to explain it, different nuances I didn& #39;t think of, and cool new attacks.
3/n
3/n
People expect me to be an expert on all things Kerberoast. I& #39;m not 100% sure I can say that anymore. People like @harmj0y, @elitest and others (I feel terrible not mentioning here because my memory sucks) continue to evolve this way beyond what I imagined or can understand.
4/n
4/n
Morning of my DerbyCon Kerberoast talk, @gentilkiwi released code that did silver ticket better than what I was about to do in 7hrs. I was bummed at first, but I got to work with him, troubleshoot and test his new code (btw, during testing I accidentally sent him my krbtgt).
5/n
5/n
He even offered to pull his code down until after my talk (I declined). I learned a valuable lesson from him about being humble and accepting other people& #39;s help and work. He did later send me a custom compiled mimikatz with my name it. I run it from time to time and smile.
6/n
6/n
When people want to learn Kerberoasting, I point them at @PyroTek3& #39;s blog ( https://adsecurity.org/?p=2011 )">https://adsecurity.org/... since it explains it more thoroughly than I did. There& #39;s no need to re-invent the wheel when someone else does it better. Give them credit and move on.
7/n
7/n
In short, accept and embrace other people& #39;s work. We have lots of very sharp people in this industry. All of those sharp people that I& #39;ve met have been extremely humble and friendly. If they are jerks, they usually are hiding their ignorance and you can safely ignore them.
8/n
8/n
You don& #39;t need to come up with some new technique on the ATT&CK framework. Take something that already out there and make it better, faster, easier. Blog and talk about things that already exist but put your spin on it.
9/n
9/n
