Kerberoasting

Description

The attack starts from any user account at all. Administrator rights are not needed. The attacker requests a ticket for a service account, carries it to their own machine and cracks the password offline, with no further contact with the server. The server records no failed logins because there are none, and nothing suspicious happens. No lockout, no alarm. If the service account's password is short or simple, it will be broken easily. Service accounts are often old and unmaintained, with weak passwords nobody dares change in case an important business service stops. On top of that they usually hold high rights.

The whole attack depends on the strength of the service account password. Long, random passwords of 25 characters and up make offline cracking an impossible job. Group managed service accounts (gMSA) are better still, where Windows itself generates and regularly rotates long passwords. Add least privilege, so a service account cannot hold more rights than it needs, along with monitoring for unusual ticket requests, and wrap all of it in strong modern encryption, and the attacker has little chance with this one.

Examples

• A domain user account taken over in the evening can, by morning, yield the passwords of critical business services, if those run on service accounts with weak passwords.
• Rubeus is a tool that automates the extraction of Kerberos tickets for every service account found in the domain.
• Hashcat is the tool used to crack the extracted tickets offline, with no contact with the target.

Notes

• It does not need privileged access to start — any domain account will do, and that is what makes it dangerous.
• The cracking happens offline, so security tools stay silent. It differs from pass-the-hash in that it targets service accounts and their passwords rather than user hashes directly.