A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Wrong. You need three things: a valid domain user's credentials (or NTLM hash), network access to the Domain Controller on port 88, and Impacket's GetUserSPNs.py. That's it. No Windows box. No domain join. No Mimikatz. I've kerberoasted domains from a Raspberry Pi running Kali ARM. The protocol doesn't care what OS you're on.
The reality is that service accounts get terrible passwords. An admin creates a SQL service account in 2016, sets it to Sql2016!, adds it to Domain Admins because "the application needs it," and never touches it again. Eight years later, that password hasn't changed. The SPN is still set. And any authenticated user can request a TGS ticket encrypted with that password's NTLM hash.
Three Domain Admin accounts with SPNs. Passwords last set in February 2022. Two years without rotation. These are your targets. Request all tickets at once, or target the highest-value account individually.
sqldev's password is database!. A Domain Admin account. Cracked in 10 seconds. You now have full domain compromise from a standard user account and a Linux box. Total elapsed time from initial foothold: approximately 45 minutes.
The (Pwn3d!) indicator means this user has local admin on the Domain Controller. From here you can DCSync, dump the NTDS, create Golden Tickets, or simply read every file share in the domain. But in a real engagement, you document this and move on to finding additional paths for the report. One path to DA is good. Five paths is a better report.
Kerberoasting from Linux is clean, fast, and requires zero Windows infrastructure. But sometimes you're already on a Windows host, or you need the semi-manual method because Impacket is blocked. That's where Rubeus and the old-school setspn + Mimikatz combo come in.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.