Kerberos is the default authentication protocol in Microsoft Active Directory. It improves on NTLM by using tickets, stronger cryptography, and a trusted third party for authentication, but it still exposes multiple attack paths when accounts, tickets, and service configuration are weak.
This writeup covers the practical attack surface: user enumeration, ticket harvesting, password spraying, Kerberoasting, AS-REP Roasting, Pass-the-Ticket, forged tickets, and skeleton key abuse. The goal is to understand what each attack needs, what it produces, and why defenders should care.
krbtgt account and used to protect TGTs.In practice, attacking Kerberos usually means abusing weak account secrets, reusing issued tickets, or forging tickets after deeper compromise.
A TGT is only used to request service tickets. After the KDC validates the user's credentials, it creates the TGT, encrypts it with the krbtgt key, and returns it alongside a session key.
A service ticket has two important parts:
krbtgt secret.Lab requirement: For many Kerberos attacks you need proper name resolution. In a lab, add the domain controller and domain name to your hosts file first.
Kerbrute abuses Kerberos pre-authentication behavior to enumerate valid users without needing a full domain logon. This is useful because it can identify valid accounts while generating less obvious noise than standard authentication failures.
./kerbrute userenum --dc CONTROLLER.local -d CONTROLLER.local User.txtThe most valuable findings are usually service accounts and any naming conventions you can reuse in later attacks.
Rubeus is one of the most useful Kerberos attack tools for Windows environments. It supports ticket extraction, roasting, ticket requests, renewals, spraying, and ticket injection.
Ticket harvesting collects TGTs as they are seen on a host, which can later support Pass-the-Ticket or broader lateral movement.
Rubeus.exe harvest /interval:30Rubeus can test a single password across many discovered users. If successful, it can return a usable .kirbi TGT for the compromised account.
Rubeus.exe brute /password:Password1 /noticketUse this carefully in real environments because lockout policies can quickly turn low-noise testing into an operational problem.
Kerberoasting targets accounts with SPNs. Any authenticated user can request a service ticket for those services, extract the encrypted ticket material, and crack it offline to recover the service account password if it is weak enough.
Rubeus.exe kerberoastRubeus will identify roastable accounts and dump their Kerberos material for offline cracking.
python3 GetUserSPNs.py controller.local/Machine1:Password1 -dc-ip MACHINE_IP -requesthashcat -m 13100 -a 0 hash.txt Pass.txtIf the cracked service account has elevated privileges, the impact can range from service access to broad domain compromise.
AS-REP Roasting targets users with Kerberos pre-authentication disabled. In that case, an attacker can request authentication material for the account without proving knowledge of the user's password first, then crack the returned data offline.
Rubeus.exe asreproastSome formats need a small adjustment before cracking with Hashcat.
hashcat -m 18200 hash.txt Pass.txtThis attack is especially dangerous when legacy compatibility or misconfiguration leaves pre-authentication disabled on real user accounts.
Pass-the-Ticket reuses valid Kerberos tickets already stored in LSASS memory. Instead of cracking a password, the attacker exports a ticket and injects it into another logon session to impersonate the original user.
mimikatz.exe
privilege::debug
sekurlsa::tickets /exportkerberos::ptt <ticket>
klistThis is highly effective for privilege escalation and lateral movement when privileged users have authenticated to lower-trust systems.
Forged ticket attacks rely on long-term secrets rather than stolen live tickets. With the krbtgt hash, an attacker can create a golden ticket and effectively mint access for the whole domain. With a service account hash, the attacker can create a silver ticket scoped to a specific service.
mimikatz.exe
privilege::debug
lsadump::lsa /inject /name:krbtgtFor a silver ticket, replace krbtgt with the relevant service account.
Kerberos::golden /user:Administrator /domain:controller.local /sid:<SID> /krbtgt:<NTLM_HASH> /id:<RID>misc::cmdGolden tickets are broader and noisier. Silver tickets can be more discreet because they only target a specific service.
A skeleton key is a Kerberos backdoor implanted into domain controller memory. Once installed, the domain controller will accept a master password for domain accounts alongside the legitimate NT hash during Kerberos validation.
In Mimikatz, the well-known default password is mimikatz and the technique relies on RC4-related behavior.
mimikatz.exe
privilege::debug
misc::skeletonThis backdoor is memory-resident and does not persist across restart by itself, but it is still extremely dangerous because it gives immediate, covert access across the forest while active.
krbtgt account and service account secrets like crown jewels.Key point: Kerberos attacks are powerful because they often convert small configuration mistakes into reusable credentials, reusable tickets, or fully forged trust.