As far as I know, in order to create a Golden Ticket, the attacker needs to obtain the krbtgt's password's hash, which is not a trivial task. My question is: is it possible to find the krbtgt's password by getting a legitimate TGT (encrypted with the krbtgt's password's hash) from the Authentication Server and cracking it, just like in a classic Kerberoasting attack?


Theoretically? Sure. It's just a brute force attack.

Practically? No, probably not. It's a brute force attack against a key derived from a randomly generated password that ends up being a hundred plus characters long in the easy case, or a randomly generated key that's 16-32 bytes long.

  • Thank You! All of the sources I came across did not mention that method (even in theoretical way), so I started to think that I am missing something important in the whole Kerberos mechanism. Sep 26 '20 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.