What is Kerberoasting?

Kerberoasting is an Active Directory attack where adversaries request Kerberos service tickets and crack them offline to obtain service account passwords for privilege escalation.

What is Kerberoasting?

Kerberoasting is an Active Directory attack technique where any authenticated domain user requests Kerberos TGS (Ticket Granting Service) tickets for service accounts with SPNs (Service Principal Names). These tickets are encrypted with the service account's password hash, allowing offline brute-force cracking without generating failed login attempts.

How does Kerberoasting work?

An attacker with any domain user account queries AD for accounts with SPNs, requests TGS tickets for those services using legitimate Kerberos protocol, exports the tickets, and cracks them offline using tools like Hashcat or John the Ripper. If the service account has a weak password, the plaintext credential is recovered.

Why is Kerberoasting effective?

Kerberoasting is effective because it requires only basic domain user privileges, uses legitimate Kerberos protocol operations that blend with normal traffic, enables offline cracking without account lockout, many service accounts have weak or never-changed passwords, and service accounts often have elevated domain privileges making them high-value targets.

How do you detect Kerberoasting?

Detection involves monitoring Event ID 4769 for unusual TGS ticket requests, alerting on single users requesting tickets for multiple services, monitoring for RC4 (etype 0x17) encryption downgrades in ticket requests, using honeypot service accounts with SPNs to detect enumeration, and correlating ticket requests with known attack tool signatures.

How do you prevent Kerberoasting?

Prevention requires using Group Managed Service Accounts (gMSA) with automatically rotated 120-character passwords, enforcing 25+ character passwords for traditional service accounts, using AES encryption instead of RC4, minimizing service accounts with SPNs, implementing the Protected Users security group, and regularly auditing SPN assignments.

What is the difference between Kerberoasting and AS-REP Roasting?

Kerberoasting targets service accounts with SPNs by requesting TGS tickets. AS-REP Roasting targets user accounts with Kerberos pre-authentication disabled by requesting AS-REP responses. Both enable offline password cracking, but Kerberoasting is more common since most environments have service accounts with SPNs while pre-auth disabled is less frequent.

What tools are used for Kerberoasting?

Common tools include Rubeus (C# implementation for Windows), Impacket GetUserSPNs.py (Python for Linux), PowerView or PowerSploit for enumeration, Mimikatz for ticket extraction, Hashcat and John the Ripper for offline cracking, and BloodHound for identifying high-value Kerberoastable accounts with admin privileges.

What happens after a successful Kerberoasting attack?

After cracking a service account password, attackers use those credentials for lateral movement, privilege escalation, and accessing resources the service account can reach. If the service account has domain admin privileges, the attacker achieves full domain compromise. Even limited service accounts often access sensitive databases or applications.