Kerberos Attack Techniques: Kerberoasting and Golden Ticket

Kerberoasting is an attack where an attacker requests Kerberos service tickets for accounts registered with SPNs (service accounts), then extracts the encrypted portion of those tickets and cracks them offline. Any domain user can request service tickets for any SPN, requiring no special privileges to perform the initial extraction.

Service account passwords are set by administrators and rarely changed, sometimes persisting for years or indefinitely. Many organizations use weak, human-memorable passwords for service accounts rather than strong random strings. This makes Kerberoasting highly effective: offline cracking of a service ticket often succeeds within hours or days.

Pass-the-Ticket (PtT) attacks involve stealing Kerberos tickets from a compromised system's memory and injecting them into another session. Because Kerberos tickets are bearer tokens (valid for their lifetime regardless of where they are used), stolen tickets grant access to services without knowing the account's password.

Mimikatz is an open-source tool that can extract Kerberos tickets, NTLM hashes, and other credentials from the Windows LSASS (Local Security Authority Subsystem Service) process memory. The sekurlsa::tickets command dumps all cached Kerberos tickets, enabling Pass-the-Ticket attacks from a compromised workstation.

A Golden Ticket is a forged TGT created using the krbtgt account's password hash. With the krbtgt hash (obtained via a DCSync attack or domain controller compromise), an attacker can forge TGTs for any user with any group memberships, with any validity period, enabling persistent domain-wide access even after password resets.

A Silver Ticket is a forged service ticket created using the service account's password hash. Unlike a Golden Ticket, a Silver Ticket does not require the krbtgt hash and is not validated by the KDC during use. Silver Tickets are more limited (one service only) but are harder to detect as they generate no KDC traffic.

AS-REP Roasting targets accounts that have "Do not require Kerberos preauthentication" enabled. Without pre-authentication, any attacker can request an AS-REP for that account and receive the encrypted TGT portion, which can then be cracked offline. Accounts with this flag set are typically service accounts or legacy compatibility configurations.

The Skeleton Key malware patches the KDC process in memory on a domain controller, injecting a universal "skeleton" password that works for all accounts while their legitimate passwords continue to function normally. This attack requires domain admin access to deploy but creates a persistent backdoor that survives most detection methods.

Windows Event ID 4769 (Kerberos Service Ticket Request) with RC4 encryption type (0x17) indicates Kerberoasting, as legitimate modern clients use AES. Event ID 4768 without pre-authentication indicates AS-REP roasting targets. Unusual ticket requests for accounts that are not regularly accessed also signal potential Pass-the-Ticket activity.

Group Managed Service Accounts (gMSAs) are the primary defense against Kerberoasting. gMSAs have 240-character randomly generated passwords automatically rotated every 30 days by Active Directory. These passwords are cryptographically impossible to crack within the rotation window, rendering Kerberoasting attacks on gMSAs ineffective.

The Protected Users security group applies strict Kerberos policies to members: no NTLM authentication, no RC4 encryption, no credential delegation, minimum 4-hour TGT lifetime. Adding sensitive accounts (executives, admins) to Protected Users significantly reduces the attack surface for credential theft and ticket-based attacks.

Why is Kerberoasting particularly effective against service accounts with human-set passwords?

Kerberoasting cracks service tickets offline using weak service account passwords. Pass-the-Ticket reuses stolen tickets from memory. Golden Ticket forges TGTs using the krbtgt hash. Silver Ticket forges service tickets without KDC validation. AS-REP roasting targets accounts without pre-auth. Defenses: gMSAs (immune to Kerberoasting), Protected Users group, AES-only encryption enforcement, Event ID 4769 monitoring.