Active › Module 3 › Lesson 2
TGS TGT Named
TGT grants further tickets; TGS proves access to a service — name the exchange on $LAB_AD; defenders watch anomalous TGS patterns.
Visual · t25_tgs_tgt_named
TGT/TGS literacy. $LAB_AD only. Original Cyberlium.
Opening
Logon starts with TGT; service access uses TGS — know the two-step dance before naming Kerberoast.
AS-REQ/AS-REP: user authenticates to KDC, receives TGT (encrypted with krbtgt hash). TGS-REQ/TGS-REP: client presents TGT, requests ticket for service SPN, receives TGS for that service. Service validates TGS without seeing user password. Cyberlium diagrams TGT→TGS flow on YOUR $LAB_AD — not capturing tickets from stranger sessions. Next: SPN Named.
1. TGT exchange (named)
Initial authentication yields TGT bound to user and domain krbtgt account. TGT is reusable until expiry for requesting service tickets — stolen TGT enables Pass-the-Ticket class (named later with mitigations).
On $LAB_AD, sketch AS-REQ → AS-REP → TGT in notes — no wire capture of neighbor traffic.
Command guide
Try these commands — TGT exchange (named)
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: curl, grep. Reference sites: TGT/TGS explained (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview); MITRE T1558.003 Kerberoasting (https://attack.mitre.org/techniques/T1558/003/); CISA AD security (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. TGS exchange (named)
Client sends TGS-REQ with TGT and desired SPN. KDC returns TGS encrypted with service account key. Kerberoast class abuses offline crack of TGS for user-owned SPNs — mitigated with strong passwords and gMSA.
Defenders alert on unusual TGS-REQ volume, RC4 downgrade patterns, and service accounts without gMSA.
3. Pass-the-Ticket literacy (preview, mitigations)
PtT reuses stolen ticket material — defender mitigations: short lifetimes, Credential Guard on endpoints, monitoring 4769 anomalies, protected users group for admins.
Ship: TGT/TGS flow diagram with AS/TGS labels and one mitigation per stage. Next: SPN Named.
4. What you ship: TGT/TGS flow for $LAB_AD
AS/TGS exchange diagram with defender notes. $LAB_AD named. NO ticket capture on strangers. chmod 600.
5. What you record before the next lesson
Date. TGT/TGS flow. $LAB_AD named. File t25-m03-l02-tgs-tgt-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capture TGS from production Wi‑Fi. Publish PtT cookbook for live tenants.
Right
Draw TGT/TGS flow with mitigations for YOUR $LAB_AD notes. Next: SPN Named.
Mission: diagram TGT/TGS flow
1) Label AS-REQ/AS-REP and TGS-REQ/TGS-REP. 2) Note what TGT vs TGS proves. 3) Add one PtT mitigation. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Link 4768 to TGT and 4769 to TGS in defender notes.
Knowledge Check
APPLY: TGT/TGS literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: TGS-REP delivers a service ticket for a requested SPN.
True or False
Knowledge Check
APPLY: Pass-the-Ticket mitigation includes:
Multiple choice