As far as I know, in order to create a Golden Ticket, the attacker needs to obtain the krbtgt's password's hash, which is not a trivial task. My question is: is it possible to find the krbtgt's password by getting a legitimate TGT (encrypted with the krbtgt's password's hash) from the Authentication Server and cracking it, just like in a classic Kerberoasting attack?

1 Answer 1


Theoretically? Sure. It's just a brute force attack.

Practically? No, probably not. It's a brute force attack against a key derived from a randomly generated password that ends up being a hundred plus characters long in the easy case, or a randomly generated key that's 16-32 bytes long.

  • Thank You! All of the sources I came across did not mention that method (even in theoretical way), so I started to think that I am missing something important in the whole Kerberos mechanism. Sep 26, 2020 at 19:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .