skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

kerberos-roasting

Extract and crack Kerberos service tickets and AS-REP hashes for offline password recovery.

253|37|Updated Feb 22, 2026
Search Tags:#password cracking#kerberos#kerberoasting#active directory#as-rep roasting#impacket#rubeus
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill kerberos-roasting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kerberos-roasting
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/kerberos-roasting
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill kerberos-roasting

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires impacket, rubeus, netexec, bloodyAD, targetedKerberoast.py, timeroast.py, kirbi2john.py, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the extraction and cracking of Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) to uncover weak passwords for offline analysis.

Core Features & Use Cases

  • Kerberoasting: Extracts Ticket Granting Service (TGS) tickets for service accounts with Service Principal Names (SPNs).
  • AS-REP Roasting: Extracts Authentication Service (AS) REP hashes from accounts that do not require pre-authentication.
  • Use Case: A penetration tester can use this skill to identify service accounts with weak passwords, which can then be leveraged for further network compromise.

Quick Start

Extract Kerberos TGS hashes for all accounts with SPNs from the domain controller at 10.0.0.5 using the provided domain user credentials.

Frequently Asked Questions about kerberos-roasting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract Kerberos service tickets for offline password cracking?▼

Kerberoasting extracts Ticket Granting Service (TGS) tickets for Active Directory service accounts with Service Principal Names (SPNs) using tools like Impacket or Rubeus, enabling offline password recovery.

What is AS-REP roasting and when do I need it for Active Directory accounts?▼

AS-REP roasting extracts Authentication Service hashes from accounts that do not require pre-authentication. It is needed when targeting AD accounts with disabled pre-authentication to uncover weak passwords offline.

Can I use netexec and Rubeus for targeted Kerberoasting via ACL abuse?▼

Yes, netexec and Rubeus support targeted Kerberoasting. This approach utilizes ACL abuse to target specific accounts rather than extracting all available service tickets across the domain.

Do I need valid domain user credentials to extract TGS hashes from a domain controller?▼

Yes, standard Kerberoasting requires valid domain user credentials to authenticate and extract TGS hashes for all accounts with SPNs from the target domain controller.

Does this Skill support hash extraction for accounts without SPNs?▼

Yes, targeted Kerberoasting uses ACL abuse to extract hashes from specific accounts without SPNs, while AS-REP roasting extracts hashes from accounts with pre-authentication disabled.

Related Skills

Explore More Software Engineering Skills→
blacklanternsecurityblacklanternsecurity
253

credential-dumping

Automate credential extraction from Active Directory via DCSync, NTDS.dit, and SAM.

Official
Advanced
zebbernzebbern
34

John the Ripper Password Cracking

Crack password hashes and encrypted files using John the Ripper modes.

Community
Intermediate
YukiIto1999YukiIto1999

exploiting-kerberoasting-with-impacket

Extracts Kerberos TGS ticket-hashes from Active Directory service accounts via Impacket's GetUserSPNs.py for offline cracking with Hashcat or John the Ripper.

Community
Advanced
AeonDaveAeonDave
15

kerbrute

Enumerate Active Directory usernames and test passwords via Kerberos pre-authentication.

Community
Intermediate