Kerberoasting

Kerberoasting abuses a legitimate feature of Kerberos: any authenticated user can ask the Ticket Granting Service for a service ticket to any account that has a Service Principal Name. Each ticket comes back encrypted with the service account’s password-derived key, so the attacker takes the tickets away and cracks them offline. No failed logons, no lockouts, no elevated privileges required to start.

The attack works because service accounts are often the weak point of a domain: human-set passwords that never expire, wide privileges, and no multifactor protection. A cracked service account hash then feeds directly into a silver ticket attack or plain credential reuse. Defences the exam rewards: long random service account passwords, group managed service accounts, AES instead of RC4 for ticket encryption, and monitoring for unusual volumes of service ticket requests.

Exam relevance: the tell is “offline password cracking of service tickets” or “any authenticated user, no privileges required”. Kerberoasting targets service accounts specifically; if the scenario cracks a user’s logon credential or forges tickets outright, a different attack is in play.