1. Request service tickets
GetUserSPNs.py -request asks the KDC for service tickets (TGS) tied to service accounts, the heart of kerberoasting.
GetUserSPNs.py corp.local/user -requestTyporithm · hard
Kerberoasting & Relaying
ad-attackspentestkerberoastresponderntlm-relay
Saved on this device
Full lesson · 8 learning steps Open any exercise for focused practice
10%
Step 1 of 8 · intro card
Learn Kerberoasting & Relaying
Active Directory
Kerberoasting requests service tickets (TGS) to crack offline with hashcat mode 13100, exposing weak service-account passwords. Responder poisons LLMNR/NBT-NS to capture hashes, and ntlmrelayx relays NTLM auth where SMB signing is off. The defensive controls are strong service-account passwords, disabling LLMNR, and enforcing SMB signing.
Kerberoasting abuses a normal Kerberos feature: any domain user can request a service ticket (TGS) for an account with a Service Principal Name. The ticket is encrypted with the service account's password hash, so GetUserSPNs.py -request grabs it and the tester cracks it offline with hashcat mode 13100. Weak or stale service-account passwords fall fast — the control is strong, long, managed passwords (or group Managed Service Accounts).
Responder exploits LLMNR and NBT-NS fallback name resolution: when a client mistypes a hostname, it broadcasts a query, and Responder answers it to capture the NTLM authentication hash. Disabling LLMNR and NBT-NS removes that fallback entirely, so there is nothing to poison.
ntlmrelayx takes captured NTLM authentication and relays it to another host. If SMB signing is not enforced, the relayed session is accepted as the victim. Enforcing SMB signing makes the relay fail, because the server requires a signature the attacker cannot forge.
01
Kerberoast: request TGS, crack offline (hashcat -m 13100).
02
Responder poisons LLMNR/NBT-NS for hashes.
03
Defense: strong service passwords, no LLMNR, SMB signing.
GetUserSPNs.py corp.local/user -request
responder -I eth0
ntlmrelayx.py -t smb://target
# crack the TGS offline with hashcat -m 13100Read the implementation
Connect each part of the code to the concept before you type.
2. Poison name resolution
Responder answers LLMNR/NBT-NS broadcasts on the interface to capture authentication hashes.
responder -I eth03. Relay NTLM auth
ntlmrelayx relays captured NTLM authentication to a target where SMB signing is not enforced.
ntlmrelayx.py -t smb://target4. Offline cracking
Mode 13100 is hashcat's Kerberos TGS format; cracking happens offline, so weak service passwords fall.
# crack the TGS offline with hashcat -m 13100A complete learning loop
01
Understand
Read the concept map and follow the code breakdown.
02
Reconstruct
Type the implementation, repair mistakes and work through every recall exercise.
03
Verify
Use the final check without hints; revisit weak concepts in short practice sessions.