Kerberoasting
Kerberoasting extracts Kerberos service tickets for offline password cracking, exploiting weak service account passwords in Active Directory environments.
Kerberoasting extracts Kerberos service tickets for offline password cracking, exploiting weak service account passwords in Active Directory environments.
Continue your mission
Kerberoasting is an attack technique targeting the Kerberos authentication protocol in Active Directory environments. It allows any authenticated domain user to request service tickets for accounts with Service Principal Names (SPNs) and then crack those tickets offline to reveal plaintext passwords. The attack exploits the fact that TGS tickets are encrypted with the service account's password hash, making weak passwords vulnerable to brute-force cracking.
An attacker with valid domain credentials enumerates accounts that have SPNs registered in Active Directory. They then request TGS tickets for those service accounts through normal Kerberos protocol operations, which raises no alarms since this is standard authentication behavior. The encrypted portion of each ticket is extracted and fed into offline cracking tools such as Hashcat or John the Ripper. If the service account uses a weak or commonly used password, the attacker recovers the plaintext credential. Service accounts often have elevated privileges, giving the attacker significant lateral movement capability.
Kerberoasting is one of the most effective privilege escalation techniques in Active Directory because it requires no special privileges beyond basic domain authentication. Service accounts frequently have weak passwords and excessive permissions, making them high-value targets. Detection is challenging because the ticket requests appear as legitimate Kerberos traffic. Organizations should enforce long, complex passwords on all service accounts, use Group Managed Service Accounts where possible, and monitor for anomalous TGS request patterns targeting multiple SPNs from a single source.
CDA Theater missions that address topics covered in this article.
Rogue access point detection identifies unauthorized wireless APs on the network using WIPS sensors, wired-side monitoring, and signal triangulation to prevent network bypass.
LLM security risks include data leakage, prompt injection, model supply chain attacks, and unauthorized tool execution, requiring organizations to treat AI models as high-privilege components.
Written by CDA Editorial
Found an issue? Help improve this article.