Kerberoasting

Kerberoasting cracks service-account passwords offline by abusing the Kerberos TGS exchange. Any authenticated domain user may request a service ticket (TGS) for any service principal name (SPN); part of that ticket is encrypted with the service account’s long-term key. Under RC4 (etype 23) that key is the account’s NT hash — so the ticket is a password-derived ciphertext the attacker can take away and brute force without ever touching the service or generating further domain traffic. MITRE T1558.003, Credential Access.

The attack was named by Tim Medin (SANS HackFest 2014, “Attacking Kerberos: Kicking the Guard Dog of Hades”). It matters because service accounts frequently have weak, old, rarely-rotated passwords — and often run with elevated (sometimes domain-admin) privileges, so a cracked hash yields lateral movement or privilege escalation.

Why it works

In the TGS-REP, the KDC encrypts the service ticket with the key of whichever account the SPN is registered to. Host-based SPNs map to machine accounts (long random passwords — not worth cracking); arbitrary SPNs registered to user accounts are the targets. No authorization check occurs at ticket request time: requesting a ticket is a normal, logged-but-benign operation.

RC4_HMAC_MD5 (etype 23) tickets are preferred by attackers because the RC4 key is the NT hash — fast to crack (~billions of guesses/sec on GPU). AES128/256 etypes (17/18) are crackable in principle but far slower. Downgrade is often possible because RC4 remains enabled for legacy compatibility.

Enumeration — finding roastable accounts

Roastable = user account with an SPN registered. Tools:

• Impacket GetUserSPNs.py (requires any valid domain credential):

# List + request crackable tickets for all SPN-bearing user accounts
GetUserSPNs.py ${DOMAIN}/${USER}:${PASSWORD} \
    -dc-ip $DC_IP -request
 
# Save hashes straight to a file
GetUserSPNs.py -request -dc-ip $DC_IP \
    ${DOMAIN}/${USER}:${PASSWORD} -save -outputfile $OUTFILE

• PowerView: Get-DomainUser -SPN (or Get-NetUser -SPN in older versions).
• BloodHound: marks “Kerberoastable” user accounts as first-class edges.
• setspn.exe: setspn -Q */* (noisy, built-in).

Clock skew breaks requests — Kerberos SessionError: KRB_AP_ERR_SKEW means sync time with the DC first (ntpdate $DC_IP or sudo timedatectl).

Extraction

Impacket (remote, Linux)

Covered above — -request outputs hashes in Hashcat-compatible format directly.

Rubeus (Windows, on-domain)

# Roast all kerberoastable accounts
Rubeus.exe kerberoast
 
# RC4 downgrade only / specific user / output to file
Rubeus.exe kerberoast /rc4
Rubeus.exe kerberoast /user:svc-sql /outfile:hashes.txt

Invoke-Kerberoast (PowerShell, no binary on disk)

Invoke-Kerberoast -OutputFormat Hashcat |
    Select-Object Hash |
    Out-File -FilePath "$OUT" -Width 8000

The -Width 8000 matters — default console width truncates long ticket hashes.

Cracking

Hash type	Hashcat mode	John
Kerberos 5 TGS-REP etype 23 (RC4)	13100	--format=krb5tgs
Kerberos 5 TGS-REP etype 17 (AES128)	19600	--format=krb5tgs
Kerberos 5 TGS-REP etype 18 (AES256)	19700	--format=krb5tgs

hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule

Detection

• Event 4769 (TGS requested) — the canary. Alert on spikes of RC4 (0x17) requests, especially for SPNs tied to user accounts, from a single source. Honey SPN accounts with fake passwords give near-zero-false-positive alerts.
• AES-capable accounts suddenly requesting RC4 tickets = downgrade indicator.
• Windows Server 2016+/Azure ATP (Defender for Identity) has native Kerberoasting detections.

Defenses

1. Strong service-account passwords — 25+ char random, or gMSA (group Managed Service Accounts, 240-char machine-rotated) wherever possible. This is the primary mitigation: an uncrackable password makes the ticket worthless.
2. Never run services as domain admin — roast then yields limited value.
3. Require AES (disable RC4 on service accounts: msDS-SupportedEncryptionTypes) — doesn’t prevent cracking but raises cost by orders of magnitude; also makes RC4 requests anomalous and alertable.
4. Monitor 4769 as above; trim unnecessary SPNs from user accounts.

Related: kerberos, as-rep-roasting, golden-and-silver-ticket-attacks, impacket, rubeus, ntlm-relay-attacks, targeted-kerberoasting, kerberos-delegation-abuse.

Sources

• MITRE ATT&CK T1558.003 — Kerberoasting
• 2015 — Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain
• 2016 — Kerberoasting Without Mimikatz
• Attacking Kerberos: Kicking the Guard Dog of Hades
• Hashcat example hashes