The term Kerberoasting is derived from:

• Kerberos (the authentication system used in Active Directory)
• The word roasting, a slang term, in security meaning extracting and cracking something offline

---

What is Kerberoasting

Kerberoasting is a post-exploitation attack targeting Active Directory environments. Specifically service accounts with Service Principal Names (SPNs)

1. Attacker gains any valid domain user access (no privileges, just a normal domain user)
2. Requests a Kerberos service ticket (TGS) for a service
3. Domain Controller returns the ticket encrypted with the service account’s password hash
4. Extracts the ticket and performs offline cracking to get the plaintext password

The vulnerability exists because:

• Kerberos uses symmetric encryption tied to the service account password
• The attacker can request encrypted data and attempt to crack it offline without interacting with the domain again

---