Kerberos and Kerberoasting
Understand the ticket dance, then abuse it to crack service passwords offline.
What you will learn
- -Trace the Kerberos authentication flow step by step
- -Explain what a Service Principal Name is and why it matters
- -Perform a kerberoasting attack and crack the result offline
is how AD proves who you are without sending your across the wire. It works with tickets issued by the . Understand the flow and one of its design choices hands you a way to steal passwords.
The ticket dance
Kerberos has three parties: the , the Key Distribution Center (KDC, which runs on the DC), and the service you want to reach. The flow:
- AS-REQ / AS-REP: the client proves it knows its password and receives a Ticket Granting Ticket (), encrypted with the KDC's own key.
- TGS-REQ / TGS-REP: the client presents the TGT and asks for a ticket to a specific service. The KDC returns a (TGS).
- AP-REQ: the client presents the service ticket to the service, which trusts it because it is encrypted with the service account's .
That last point is the whole game. A service ticket is encrypted with the hash of the service account's password. If you can a service ticket, you are holding that only that password can produce.
SPNs: the name of a service
A Service Principal Name (SPN) links a service to the account that runs it,
in the form MSSQLSvc/db01.corp.local:1433. Any authenticated user can ask the
KDC for a service ticket to any SPN. The KDC does not check whether you are
actually allowed to use that service. It just hands over the ticket.
Kerberoasting: crack the password offline
Put it together. As a normal user, you request service tickets for accounts that have SPNs, extract the encrypted blob, and crack it offline at whatever speed your hardware allows. No traffic to the DC during cracking, no lockouts, no alarms.
$netexec ldap 10.10.10.5 -u jdoe -p Passw0rd --kerberoasting roast.txt$hashcat -m 13100 roast.txt rockyou.txtService accounts are prime targets because they often have weak, rarely-rotated passwords and sit in privileged groups.
needs only one valid account and never touches the target service. The crack happens entirely offline, so account lockout policies and monitoring do not slow you down. Strong service passwords and Group Managed Service Accounts are the real defense.
What password hash is a kerberoastable service ticket encrypted with?
Which Kerberos message returns the service ticket you crack in kerberoasting?
Recall the two round trips. The AS exchange gives you a TGT. The next exchange asks for a ticket to a named service.