Kerberoasting

Kerberoasting is an attack that targets service accounts in Active Directory. Any authenticated domain user can request a service ticket for an account that has a Service Principal Name (SPN).

Part of that ticket is encrypted with the service account's password hash, so the attacker can crack it offline without ever touching the account.

When a user requests a service ticket (TGS), the KDC encrypts part of it with the NTLM hash of the service account's password.

Because any domain user can request this ticket, and because no special privileges are needed, the attacker simply collects tickets and cracks them at leisure on their own machine.

First, enumerate accounts that have SPNs set. These are usually service accounts running SQL, web, or other services.

User accounts (not machine accounts) with SPNs are ideal targets, because their passwords are often set by humans and rarely rotated.

Rubeus is a popular C# tool for Kerberos abuse. The kerberoast command requests TGS tickets for SPN accounts and outputs them in a crackable format.

This step is quiet: it looks like normal Kerberos traffic from a legitimate user.

From Linux, Impacket's GetUserSPNs.py performs the same attack remotely using valid domain credentials.

This is handy during external or assumed-breach engagements where you already have one set of low-privileged credentials.

The captured ticket is saved in a format Hashcat recognizes as mode 13100 (Kerberos 5 TGS-REP etype 23, RC4).

Each hash begins with $krb5tgs$23$ followed by the SPN, account, and encrypted blob. This is what you feed to your cracker.

Offline cracking uses a wordlist (often with rules) against the captured hashes. Because RC4 tickets are fast to test, weak service passwords fall quickly.

This is why service account passwords should be long and random, ideally managed by Group Managed Service Accounts (gMSA).

If the account supports RC4 (etype 23), cracking is fast. If it only allows AES (etype 17/18), cracking is far slower but still possible (Hashcat modes 19600/19700).

Attackers may even downgrade the requested encryption type to force the weaker RC4 ticket.

Defenders watch for unusual volumes of TGS requests, especially for RC4 tickets (event ID 4769). Mitigations include:

• Long, random service account passwords (25+ characters).
• Using gMSA accounts with automatic rotation.
• Disabling RC4 and enforcing AES.

Service accounts are attractive because they are frequently members of privileged groups, have stale passwords, and are not tied to a single human who would notice anomalies.

Cracking one can hand you Domain Admin if the service account was carelessly over-privileged.

Kerberoasting is usually performed soon after gaining any domain foothold. It is low-noise enumeration plus offline cracking, so it rarely trips alerts.

A cracked service account often yields lateral movement or privilege escalation, making it a staple of internal pentests and red team engagements.

Recall the core requirement for Kerberoasting.

You now understand Kerberoasting:

• Any domain user can request TGS tickets for SPN accounts.
• Tickets are encrypted with the service account hash and cracked offline.
• Tools: Rubeus, Impacket GetUserSPNs.py, cracked with Hashcat mode 13100.
• Defend with long passwords, gMSA, and AES-only encryption.

Next you will reuse credentials directly with Pass-the-Hash.