Active Directory: Kerberoasting a Service Account

Scenario

You hold a low-priv domain account. Any authenticated user can request Kerberos service tickets (TGS) for accounts with an SPN — and crack them offline without touching the DC.

Attack path

1. GetUserSPNs.py -request (Impacket) or Rubeus kerberoast to pull a $krb5tgs$ hash.
2. Crack it with hashcat mode 13100 against rockyou.
3. The cracked password unlocks a note the service account left in SYSVOL.

Recover the flag

That note's contents are XOR-encoded with the three-letter ticket type you requested. Decode (XOR key = UTF-8) to reveal your flag.