Kerberos Attack Techniques: Kerberoasting and Golden Ticket

Kerberoasting is an attack where an attacker requests Kerberos service tickets for accounts registered with SPNs (service accounts), then extracts the encrypted portion of those tickets and cracks them offline. Any domain user can request service tickets for any SPN, requiring no special privileges to perform the initial extraction.

Service account passwords are set by administrators and rarely changed, sometimes persisting for years or indefinitely. Many organizations use weak, human-memorable passwords for service accounts rather than strong random strings. This makes Kerberoasting highly effective: offline cracking of a service ticket often succeeds within hours or days.