📖 What is Kerberoasting?
Kerberoasting is a post-exploitation technique used to extract Kerberos service tickets (TGS) from Active Directory and crack them offline to obtain service account passwords. This attack targets accounts with Service Principal Names (SPNs) assigned to them.
"This attack is particularly dangerous because it does not require administrative privileges to request a ticket, making it a common path for privilege escalation."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Kerberoasting?
- ▸ Service Principal Names (SPNs) are unique identifiers that associate a service instance with a service account, allowing users to request tickets for that specific service.
- ▸ Any authenticated domain user can request a Ticket Granting Service (TGS) ticket for any account with an SPN, regardless of their current privilege level.
- ▸ The encrypted portion of the TGS ticket is extracted and cracked offline using tools like Hashcat, avoiding detection by account lockout policies on the domain.
- ▸ Successful cracking reveals the service account's plaintext password, which often possesses elevated privileges, facilitating lateral movement or full domain compromise within the environment.
- ▸ Detection typically involves monitoring for an unusual volume of TGS requests, specifically Event ID 4769, originating from a single source in a short timeframe.
🎯 How does Kerberoasting appear on the PT0-002 Exam?
A scenario might describe a penetration tester who has gained a foothold as a low-privileged domain user and needs to escalate privileges without triggering account lockouts.
You may be asked to identify the specific process used to extract service tickets from Active Directory for the purpose of offline password cracking using a dictionary attack.
Expect questions where you must distinguish Kerberoasting from AS-REP Roasting, specifically focusing on whether a pre-authentication ticket is required or if an SPN is being targeted.
❓ Frequently Asked Questions
How does Kerberoasting differ from AS-REP Roasting?
Kerberoasting targets service accounts with SPNs and requires a valid TGT to request a TGS. AS-REP Roasting targets users with 'Do not require Kerberos preauthentication' enabled and does not require an initial TGT.
Why is Kerberoasting considered a stealthy attack?
Because the password cracking happens offline on the attacker's own hardware, it does not generate failed login events on the domain controller, making it invisible to traditional account lockout policies.
What is the most effective way to mitigate this attack?
Implementing Group Managed Service Accounts (gMSAs) is the best defense, as they use long, complex, and automatically rotated passwords that are virtually impossible to crack via offline brute-force.