Kerberoasting has been public since 2016 and it still works, because the underlying design has not changed: any authenticated domain user can request a service ticket for any account that has a Service Principal Name, and that ticket is encrypted with the target account’s password hash.
If the service account’s password is weak, the hash comes off in minutes.
What actually happens
- You authenticate to the KDC as any domain user.
- You request a ticket for
MSSQLSvc/db01.lab.local:1433. - The KDC returns a
TGS-REPencrypted with the service account’s NTLM hash. - You take that ciphertext offline and crack it.
No elevated privileges anywhere. That is the whole trick.
Finding accounts with SPNs
From a domain-joined Linux box with the credentials of a plain user:
impacket-GetUserSPNs lab.local/jdoe:'Password123!' -dc-ip 10.10.10.10 -request
Or without credentials at all, if you have any valid session and can use LDAP anonymously — many domains still permit it:
impacket-GetADUsers lab.local/ -dc-ip 10.10.10.10 -all
The output lists accounts and their service names. Two categories matter:
- User accounts with SPNs — the password is probably a human-chosen string. Excellent targets.
krbtgtand machine accounts — 120-character random passwords. Ignore them.
Requesting the tickets
-request makes GetUserSPNs fetch a crackable hash for every account it finds:
$krb5tgs$23$*svc_sql$LAB.LOCAL$MSSQLSvc/db01.lab.local:1433*$8f3a...
Save it and move to the cracking box.
Cracking offline
Because it’s Kerberos RC4 or AES, hashcat handles it directly:
# $krb5tgs$23$ = RC4 (etype 23)
hashcat -m 13100 tgs.txt rockyou.txt -r rules/best64.rule
# $krb5tgs$18$ = AES-256 (etype 18) — much slower, still worth running
hashcat -m 19700 tgs_aes.txt rockyou.txt
The RC4 variant is roughly 100x faster to crack than AES-256. If you only have AES tickets, mask attacks are usually a dead end — targeted wordlists built from the organisation’s vocabulary work better than brute force.
A dictionary the client’s own marketing site produced will beat rockyou.txt more often than people expect.
Two things people get wrong
You do not need to be an admin. Every writeup that implies otherwise is wasting your time. Any domain user can do this.
AES is not a fix by itself. It raises the cracking cost, but a weak password in a wordlist still falls. The real fixes are:
- 25+ character, machine-generated service account passwords
- Group Managed Service Accounts — AD rotates a 240-character password every 30 days, and you cannot Kerberoast what you cannot crack
- Alert on anomalous
TGS-REQvolume for SPN-bearing accounts; a single user requesting 40 service tickets in a minute is not normal
Detection
From the defender’s chair, the signal is in the ticket request pattern, not the tool. Event ID 4769 with encryption type 0x17 (RC4) against accounts that normally negotiate AES is the most common indicator I’ve seen in real environments.