Kerberoasting is an attack against domain service accounts.

I have a custom Windows service written in C#. This service is running on a Windows server. This server is a member of the Active Directory domain.

The service is running as a domain standard user (service "Logon" tab). The "Service Principal Name" of this user is blank.

Is it possible to run a Kerberoasting attack against this user with a blank SPN?

1 Answer 1


No, it is no possible to Kerberoast your custom C# Windows Service that does not have a SPN. As of right now, your service is technically running locally with whatever permissions your "domain standard user" has. Kerberos Ticket Granting Server will create TGS tickets for any service with a registered SPN. The SPN format is usually seen as service_name/[email protected] Example: HTTP/[email protected], but this is a link to the official docs1 https://learn.microsoft.com/en-us/windows/win32/ad/name-formats-for-unique-spns

Once you have a valid TGT, then the next step is to ask for a TGS. Part of the TGS process is that you place a SPN inside the TGS and fire it off to the KDC. The KDC is going to open the TGS and grab the SPN that it found inside and compare it to a database of SPN's that it has. If you don't have a valid SPN you will not be able to connect to your custom C# service.

If you want to learn more about SPNs in general check out the following blogs: https://en.hackndo.com/service-principal-name-spn/


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .