Kerberos is the authentication backbone of Active Directory — and a rich attack surface. This module covers the four most impactful Kerberos-based attack techniques: AS-REP Roasting against accounts with pre-authentication disabled, Kerberoasting against service accounts, Pass the Ticket for lateral movement without credentials, and an overview of Silver and Golden Ticket persistence attacks.
Normally, a Kerberos AS-REQ includes a timestamp encrypted with the user's key. This pre-authentication step proves to the KDC that the requesting party actually knows the password before issuing a TGT. Without it, anyone can request a TGT for any user.
The DONT_REQ_PREAUTH flag (userAccountControl bit 0x400000) disables pre-authentication for a specific account. When set, the KDC responds to an AS-REQ with an AS-REP that contains data encrypted with the user's NTLM hash — without verifying who is asking. The attacker can then attempt to crack that encrypted blob offline to recover the password.
This is AS-REP Roasting: enumerate accounts with pre-auth disabled, request their AS-REP, extract the encrypted portion, crack it with Hashcat.
Crack the AS-REP hash with Hashcat mode 18200:
Any authenticated domain user can request a service ticket (TGS) for any service registered with an SPN in AD. The service ticket is encrypted with the service account's NTLM hash. The attacker requests the ticket, extracts the encrypted blob, and cracks it offline — recovering the service account's password.
The attack is particularly effective against service accounts that:
Crack with Hashcat mode 13100 (Kerberos 5 TGS-REP etype 23):
kerberoast /rc4opsec only roasts RC4-compatible SPNs to reduce AES-only detection.If you have code execution on a Windows machine where a privileged user is logged in, you can extract their Kerberos tickets from memory and inject them into your own session — authenticating as that user without needing their password. This is Pass the Ticket (PTT).
Tickets live in the LSASS process memory in Kerberos ticket caches. Mimikatz and Rubeus can export them:
Once a ticket is injected, any Kerberos-authenticated command you run uses the stolen identity. You can access SMB shares, run PsExec, or request further service tickets — all as the ticket's original owner.
Pass the Ticket steals existing tickets. Silver and Golden Ticket attacks forge tickets from scratch using a compromised account hash — no interaction with the KDC required during the forge step.
Silver Ticket — Forged using a service account's NTLM hash. The ticket grants access only to the specific service tied to that account (e.g. CIFS on a specific server). Does not require KDC interaction after forging. Less detectable than Golden Ticket because it never touches the DC. Impact: full access to that service as any user (typically DA).
Golden Ticket — Forged using the krbtgt account's NTLM hash. The krbtgt account's hash is the domain's master secret — it is used to encrypt all TGTs. With it, you can forge a TGT for any user (including a non-existent user), valid for any duration, with any group memberships. The resulting ticket bypasses all normal authentication checks. Impact: complete, long-term domain compromise. Effective until the krbtgt password is rotated twice.