AI
Kerberos Authentication Flow
Kerberos replaces NTLM’s challenge-response model with ticket-based authentication. A client encrypts the current timestamp with its password hash and sends it to the domain controller. The DC decrypts it, checks the timestamp is within the acceptable skew window, and issues a Ticket Granting Ticket (TGT) encrypted under the KRBTGT account hash.
With the TGT in hand, the client requests service tickets via TGS-REQ. It forwards the TGT opaque, includes the target service name in plaintext, and encrypts the current time with the TGT session key. One detail matters later: domain access control lists do not apply at ticket-issuance time. Any authenticated client with a valid TGT can request a ticket for any service registered in the domain.
The TGT Is Just a Service Ticket for KRBTGT
The TGT has no special status in the Kerberos protocol. As Park put it:
“in reality it’s just a service ticket for the KRBT account” — Yeonwoo Park
KRBTGT owns an SPN called kadmin/changepw. That SPN is what the AS-REQ targets, and the ticket it returns functions identically to any service ticket. Standard tooling hides this. Running Impacket’s getuserspns.py skips disabled accounts by default, so KRBTGT’s service never appears. After patching the disabled-account skip in Impacket’s getuserspns.py (12:33), the kadmin/changepw SPN surfaces. Once you see it, the AS-REQ and TGS-REQ are revealed as the same operation, just aimed at different accounts.
Why Disabled Accounts Block Service Tickets — Except KRBTGT
Park set up a domain account named Mickey with an SPN, then disabled it. Requesting a service ticket via TGS-REQ failed — Wireshark confirmed the KDC rejected it because the account was disabled. KRBTGT, also disabled, still issued tickets. Reverse-engineering kdcsvc.dll explained why: the KDC checks a hardcoded condition and branches to an error only when the target account’s SID is not 502. SID 502 is KRBTGT, universally, across every Windows domain on the planet. Every other disabled account hits the error branch.
“the exception handling code was missing when issuing a service ticket through ASRQ” — Yeonwoo Park
TGS-REQ had the exception. AS-REQ did not. That gap is the attack surface.
Disabled SPN Kerberoasting: PoC Walkthrough
In the Disabled SPN Kerberoasting live demo (18:50), Park creates two plain domain user accounts: defcam2025, which requests the ticket, and Mickey, which owns an SPN. Neither holds special privileges. He assigns a test SPN to Mickey via PowerShell, then disables the account. The PoC tool filters domain services and returns only those owned by disabled accounts. It sends the request via AS-REQ, the KDC’s conditional branch is never reached, and a service ticket for the disabled Mickey account is issued and written to disk in hashcat-ready format.
Attack Scenarios, Password Reuse, and Mitigations
The cracked hash is rarely the end goal. Service and antivirus deployment accounts frequently land in the domain admin group, get forgotten when a vendor changes, and are disabled instead of cleaned up. Crack one of those tickets and you have a real password. From there, increment the year suffix (condo2023 → condo2024), add a special character, and spray. Windows resets failed attempts every 30 minutes, so the window stays open.
The fix is one PowerShell command before decommissioning anything: enumerate domain accounts with SPNs that are already disabled. Any result that comes back means a live service ticket can be pulled against that account right now. Reactivate it, remove the SPN, then disable it again.
Notable Quotes
most commercial tools do not collect any services associated with disabled accounts Yeonwoo Park · ▶ 11:58
in reality it’s just a service ticket for the KRBT account Yeonwoo Park · ▶ 10:30
the exception handling code was missing when issuing a service ticket through ASRQ Yeonwoo Park · ▶ 18:25
Key Takeaways
- Request service tickets for disabled SPN accounts via AS-REQ to bypass KDC exception handling.
- Audit every disabled account in Active Directory for registered SPNs before decommissioning.
- Cracked passwords from disabled service accounts reveal reusable patterns for spray attacks against live accounts.
About the Speaker
Yeonwoo Park
Conducting red team operations for external/internal network penetration testing in Republic of Korea. CERTIFICATION: CRTO.