6.3.4 Request selected service tickets for offline password recovery Kerberoasting — selection and output
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A valid domain identity, selected SPN-owning account, usable KDC route and a reason its resulting identity matters.
Where to look: Enumerate SPNs first. Rank the owning account's groups/rights, account type and likely password feasibility, then request only the relevant ticket material. Map any recovered identity back to host and object rights.
Expected behavior / secure boundary: Authenticated service-ticket requests are normal Kerberos behavior. Their offline-guessable encrypted component creates a password-strength issue for susceptible accounts; SPN presence alone is not a misconfiguration.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.4.1 Enumerate without requesting tickets — Shell
Run: Kali / Linux with Impacket. Requires: Valid domain identity and directory route. Effect: Enumerates SPNs without the displayed command requesting every TGS.
impacket-GetUserSPNs -dc-ip DC_IP 'DOMAIN/USER'
6.3.4.2 Request one selected user — Shell
Run: Kali / Linux with Impacket. Requires: Valid domain identity, selected account/SPN and KDC route. Effect: Requests selected offline ticket material; no verified password is implied.
impacket-GetUserSPNs -request-user TARGET_USER -dc-ip DC_IP \
-outputfile kerberoast-TARGET_USER.hashes 'DOMAIN/USER'
What this checks: The enumeration form lists account/SPN candidates without requesting all service tickets. The selected request form in the owning procedure narrows collection; a returned cipher still needs a verified offline guess.
6.3.4.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
ServicePrincipalName: MSSQLSvc/DB01.example.test:1433
Name: svc_reports
MemberOf: Reporting Operators
Cipher prefix: $krb5tgs$23$
Cracking result: Exhausted
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| svc_reports + SPN | A service-identity candidate. | Establish why its rights are useful before spending on guessing. | §6.2.1.1 — Baseline enumeration — users and groups |
| $krb5tgs$23$ | An RC4 TGS verifier if the full material was returned. | Select the matching format; other encryption types require other modes. | §6.3.2.1 — Classify recovered credentials and their scope |
| Exhausted | The tested candidate strategy found no matching password. | Do not infer that the account has no password or the target is patched; improve justified candidates or move on. | §6.3.4.1 — Kerberoasting — selection and output |
Stop when: A selected account has a justified value/feasibility decision and any returned material is classified.
Revisit only when: New account rights or an evidence-backed candidate strategy changes feasibility.
6.3.4.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Useful account plus recovered verified password: validate its identity/access and re-enumerate. | §6.3.2.1 — Classify recovered credentials and their scope |
| Ruled out in this context | No useful downstream rights or infeasible password strategy: deprioritize. | §6.2.5.1 — Enumerate and validate effective object permissions |
| Inconclusive / failed check | Ticket request failed: diagnose account/SPN, authentication, KDC and encryption separately. | §6.5.1.1 — Diagnose the failed boundary |
6.3.4.5 Tooling and complete procedure
Kali impacket-GetUserSPNs is the baseline; Rubeus is a Windows alternative. Match returned cipher format to installed Hashcat/John support; no online spraying is implied. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.