Kerberoasting

The core advantage of Kerberoasting is that the attack shifts password cracking offline. The attacker requests a Ticket Granting Service (TGS) ticket for a target Service Principal Name (SPN). The encrypted portion of this ticket is encrypted with the service account's NTLM hash. Once extracted from memory, the attacker can attempt to crack this hash using tools like Hashcat or John the Ripper without generating network traffic or triggering account lockout policies. This makes detection significantly harder compared to online brute-force attacks.

Kerberoasting specifically targets service accounts registered with a Service Principal Name (SPN) in Active Directory. These accounts are high-value targets because:

• They often have elevated privileges to run critical services.
• They frequently have weak or never-expiring passwords due to operational constraints.
• Password changes can cause service outages, making administrators reluctant to rotate them. Any authenticated domain user can request a TGS ticket for any SPN, making this a low-barrier attack.

The crackability of a Kerberoasted ticket depends heavily on the encryption type used. The weakest is RC4-HMAC, which derives the encryption key directly from the account's NTLM hash, making it trivially crackable. Stronger types like AES-256-CTS-HMAC-SHA1-96 use PBKDF2 with salt, significantly increasing cracking difficulty. Attackers can often request a ticket specifying a weaker encryption type if the domain controller does not enforce AES, downgrading the security. Defenders must enforce AES encryption for all service accounts.

Detecting Kerberoasting requires monitoring for Kerberos TGS-REQ events (Event ID 4769) with specific characteristics:

• Requests using RC4 encryption (Ticket Encryption Type 0x17).
• A high volume of TGS requests from a single user account in a short period.
• Requests for service accounts with noisy or abnormal access patterns. Mitigation involves enforcing AES-only encryption, implementing Managed Service Accounts (MSAs) with automatic password rotation, and using Group Managed Service Accounts (gMSAs) for clustered services to eliminate static passwords entirely.

Common tools used for Kerberoasting include:

• Impacket's GetUserSPNs.py: Requests TGS tickets for all user accounts with SPNs from a domain controller.
• Rubeus: A C# toolset that can perform Kerberoasting directly from a compromised Windows host, including advanced features like kerberoast with hashcat formatting.
• PowerShell: Using Invoke-Kerberoast from the Empire framework. Extracted hashes are saved in formats compatible with Hashcat mode 13100 (Kerberos 5 TGS-REP etype 23) for cracking.

Kerberoasting is distinct from a Golden Ticket attack. A Golden Ticket forges a Ticket Granting Ticket (TGT) by compromising the KRBTGT account hash, granting domain-wide persistence. Kerberoasting is a stealthier, lower-privilege attack that extracts crackable material from legitimate TGS tickets. While a Golden Ticket requires domain admin-level access to the KRBTGT hash, Kerberoasting only requires authenticated domain user access, making it a common initial lateral movement technique after gaining a foothold.

A lateral movement technique where an attacker captures a hashed user credential and reuses it to authenticate to a remote server or service without needing the plaintext password. Unlike Kerberoasting, which targets service accounts through offline cracking, PtH exploits the NTLM authentication protocol directly.

• Mechanism: Extracts NTLM hashes from LSASS memory or SAM database
• Key Difference: No cracking required; the hash itself is the credential
• Mitigation: Credential Guard, LSA Protection, privileged access workstations

A Windows privilege escalation technique where an attacker leverages the SeImpersonatePrivilege to assume the security context of a different logged-on user, often escalating to SYSTEM. This is a post-exploitation step that can follow a successful Kerberoasting attack.

• Common Vectors: Potato family exploits (Juicy, Rotten, SweetPotato)
• Privilege Required: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege
• Result: Full SYSTEM-level access on the compromised host

A Windows virtualization-based security (VBS) feature that isolates user credentials in a protected virtualized environment. This directly mitigates Kerberoasting's prerequisite step of extracting service tickets from memory.

• Protection: Isolates secrets in VBS enclave inaccessible to OS kernel
• Impact on Kerberoasting: Prevents ticket extraction from LSASS
• Requirement: Hardware virtualization support (Intel VT-x, AMD-V)

A privilege escalation vulnerability where a program with higher authority is tricked into misusing its authority on behalf of an attacker. Kerberoasting exploits a form of this: the KDC acts as a confused deputy by issuing encrypted service tickets to any authenticated user.

• Classic Example: Cross-site request forgery (CSRF)
• Kerberos Context: Any domain user can request a TGS for any service
• Defense: Service account hardening, managed service accounts (MSAs)

A Windows managed service account type that provides automatic password management and simplified service principal name (SPN) administration. gMSAs are a primary defense against Kerberoasting because they eliminate weak, human-chosen service account passwords.

• Password Complexity: 240-character random passwords, auto-rotated
• Kerberoasting Resistance: Brute-force cracking becomes computationally infeasible
• Deployment: Requires Windows Server 2012+ domain functional level