AD AUTHENTICATION / CREDENTIAL ACCESS
Kerberoasting
Understand why service accounts with SPNs can expose crackable ticket material and how to assess the risk safely.
LEARNING OBJECTIVES
What you should be able to do
- ✓Explain SPNs, TGS requests, and offline cracking
- ✓Identify service accounts and privilege impact
- ✓Document both the technical condition and remediation
CORE CONCEPT
Understand before you run
A service ticket can contain material derived from the service account secret; weak secrets make offline guessing feasible.
The presence of an SPN is not itself a vulnerability. Password quality, account privilege, and encryption type matter.
Use lab-only credentials and record the evidence needed to reproduce the finding without exposing secrets in a report.
COMMAND REFERENCE
Quick reference
GetUserSPNs.py '<domain>/<user>:<password>' -dc-ip <dc> -requestRequest service tickets in an authorized lab
Get-DomainUser -SPN | Select samaccountname,serviceprincipalnameEnumerate accounts with SPNs
klistInspect the current Kerberos ticket cache
COMMON MISTAKES
Check yourself
- Calling every SPN account vulnerable without checking password strength or privilege.
- Leaving extracted ticket material in a shared report or repository.
- Skipping the explanation of why the service account's privileges change the impact.