Definition
Kerberoasting abuses a normal Kerberos behavior: any authenticated domain user can request a service ticket for an account with a registered service principal name. The ticket is encrypted with a key derived from that account's password, enabling offline cracking.
How the attack works
- 01The attacker holds any authenticated domain identity
- 02They enumerate accounts with service principal names
- 03They request service tickets for those accounts
- 04Tickets are cracked offline, without further domain interaction
- 05Recovered service account credentials are used for lateral movement or escalation
How adversarial validation works
From an authorized foothold, RedMaw enumerates roastable accounts and, within agreed exploitation limits, demonstrates which recovered credentials grant meaningful access, then follows the resulting path to show what it reaches.
Tags
- active directory
- credentials
- privilege escalation