A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Same account. Same password. Two different encryption types. When the SPN account supports RC4 (etype 23), Hashcat tears through rockyou.txt at 800 kH/s. The password cracks in 4 seconds. When the account only supports AES-256 (etype 18), Hashcat crawls at 10 kH/s. Same password takes 4 minutes and 36 seconds. Now imagine the password isn't in rockyou. That 100x speed difference becomes the difference between cracking in a day and cracking in a month.
The /tgtdeleg flag in Rubeus forces RC4 encryption in the TGS request, even when the target account supports AES. On Domain Controllers running Server 2016 or earlier, this works. On Server 2019 DCs, it doesn't. The DC always returns the highest encryption type the account supports. Know your DC version before you plan your attack.
Nine Kerberoastable accounts. Seven support RC4. Two are AES-only. All passwords set in 2022. The /stats flag gives you this intel without sending a single TGS request. No tickets requested means no Event ID 4769 generated. Pure reconnaissance.
/nowrap flag prevents base64 column wrapping. Without it, you'd have to manually strip newlines before feeding the hash to Hashcat. The /ldapfilter:'admincount=1' targets only accounts that have been in a protected group. These are your highest-value targets. Crack one of these and you likely own the domain.This uses built-in .NET framework classes. No executable to upload. No PowerShell script to download. AppLocker can't block System.IdentityModel because it's a signed Microsoft assembly. After the ticket is in memory, extract it with Mimikatz using kerberos::list /export, then convert the .kirbi file with kirbi2john.py for Hashcat.
You've roasted from both platforms. You understand encryption type implications. You know the opsec considerations. But there's another Kerberos attack that doesn't even require the target to have an SPN. And it works against accounts that admins explicitly configured to skip pre-authentication. ASREPRoasting is next.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.