> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/kerberos/general-kerberos-flow.md).

# Kerberos 的整体流程

针对 Kerberos 的整体流程的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。

### 第 1 步 — AS-REQ

当用户登录时，其客户端会向 KDC 发送一个查询：

```bash
AS-REQ
```

此查询对应于初始身份验证请求。

### 第 2 步 — AS-REP

如果身份验证有效，KDC 会返回一个响应：

```bash
AS-REP
```

此响应尤其包含一个 **TGT**或 **票据授予票据**.

TGT 可以视为一种通用票据，允许你查询服务票据。

### 第 3 步 - TGS-REQ

当用户想要访问某个资源时，例如网络共享，他会向 KDC 出示自己的 TGT。

然后客户端发送：

```bash
TGS-REQ
```

此请求用于查询某个特定服务的票据。

### 第 4 步 — TGS-REP

KDC 检查 TGT 并返回一张服务票据：

```bash
TGS-REP
```

此票据专用于所请求的服务。

### 第 5 步 — 访问资源

客户端向目标服务器出示服务票据。

例如，要访问：

```bash
//WS01/C$
```

客户端向服务器提交一张服务票据 `WS01`.

如果票据有效，但用户在该共享上没有必要的权限，则身份验证可能会成功，但 SMB 访问将被拒绝。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/active-directory/kerberos/general-kerberos-flow.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.