kerberoasting-active-directory - Kerberoasting Active Directory
Extract Service Principal Name ticket hashes from Active Directory and crack them offline to obtain service account passwords.
Tags
Updated: 2026-09-18Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Identify Service Principal Names
- Request TGS ticket hashes
- Crack TGS hashes offline
- Verify cracked account credentials
Inputs
- Valid domain credentials
- Domain Controller IP address
- Password wordlist
Outputs
- Extracted TGS ticket hashes file
- Plaintext service account passwords
- Assessment report
Requirements
- Authorized assessment scope
- Windows domain environment
- Installed tools Impacket Hashcat Rubeus