Understanding Kerberoasting

Kerberoasting is the attack that keeps on giving for adversaries and penesters alike. First documented in 2014 by Tim Medin, Kerberoasting is a tactic that can be used after an initial compromise to gain access to alternate accounts in an Active Directory domain.

It typically involves an attacker issuing a series of LDAP queries to a Domain Controller in search of user accounts that possess a value known as a Service Principal Name (SPN).

If this value is set on an account, an attacker can request a service ticket (ST) for the identity, which is encrypted with the account’s NT hash. This service ticket can then be cracked offline by the attacker, which, if successful, will allow them to retrieve the cleartext password of the account.

[obadiahbridges]

great video, this was exactly what I needed. Thanks

[MMNTUM]

‏ ‏‪11:17‬‏ using machine accounts instead of an AD service accounts is a bad practice.. each service running in this context on the server will have the same password, and more importantly if an attack gains local admin rights on the server he has full controll on the service as well. Adding the fact that you cant enforce policy with AD and use restrictions.. this is not a good advice, actualy the best mitigation you forgot to mantion is to add the domain service account to gMSA - Group Managed Service Accounts. This will automaticly set a strong random password and rotate it automaticly as well as other hardenings on the service account itself