←

Kerberoasting - Linux

  • You abuse Kerberos to get encrypted tickets → crack them offline → steal passwords

1. Service Accounts (the real target)

  • In Active Directory, services (SQL, web servers, etc.) run as domain accounts
  • These accounts often:
    • Have high privileges (sometimes even Domain Admin )
    • Have weak/reused passwords (because admins don’t want services to break)

2. SPNs (Service Principal Names)

  • SPN = “this account runs this service”
  • Example:
    • MSSQLSvc/server01 → tied to a service account

👉 So:

SPN = a pointer to a service account you can attack

3. Kerberos Tickets (TGS)

When you request access to a service:

  • Domain Controller gives you a TGS ticket
  • That ticket is:
    • Encrypted using the service account’s password hash

👉 This is the key vulnerability:

You can request tickets for ANY SPN… and they’re encrypted with the target’s password

⚔️ The Attack Flow

Step 1 — Be any domain user

  • No admin needed
  • Just valid credentials

Step 2 — Find SPNs

  • Identify service accounts

👉 Think:

“Which accounts are worth cracking?”

Step 3 — Request TGS tickets

  • Ask the DC for tickets for those SPNs

👉 Important:

  • This is normal behavior
  • No exploit needed
  • Hard to detect

Step 4 — Extract encrypted ticket

  • You now have:
    • A blob encrypted with the service account’s password

Step 5 — Crack offline

  • Use Hashcat / John
  • No interaction with target anymore

👉 Huge advantage:

  • No lockouts
  • No alerts
  • Infinite attempts

Step 6 — Use the password

  • If cracked:
    • Log in as that service account
    • Move laterally
    • Possibly become Domain Admin

🧠 Key Takeaways (What to remember)

  • Kerberoasting is:
    • Not exploitation
    • Abuse of normal behavior
  • You need:
    • Any domain account
  • You target:
    • SPN / service accounts
  • The goal:
    • Get encrypted tickets → crack passwords

Getting Users with GetUserSPNs.py

GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend

Getting and Saving Ticket of Specific User to File

GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user sqldev -outputfile sqldev_tgs

Cracking Ticket Offline with Hashcat

hashcat -m 13100 sqldev_tgs /usr/share/wordlists/rockyou.txt