A penetration tester performs a Kerberoasting attack against an Active Directory domain. What does this attack target and what is the success condition?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Kerberoasting requests TGS service tickets for any SPN-registered account (typically service accounts); these tickets are encrypted with the service account's password hash, which can be cracked offline to reveal the plaintext password. A is wrong because stealing the KRBTGT hash is a golden ticket attack, not Kerberoasting.
Full explanation below image
Full Explanation
B is correct because Kerberoasting requests TGS service tickets for any SPN-registered account (typically service accounts); these tickets are encrypted with the service account's password hash, which can be cracked offline to reveal the plaintext password. A is wrong because stealing the KRBTGT hash is a golden ticket attack, not Kerberoasting. C is wrong because forging PAC data is a separate privilege escalation technique (MS-PAC forgery). D is wrong because intercepting AS-REQ messages with pre-auth data for cracking describes AS-REP Roasting (targeting accounts with no pre-authentication required), not Kerberoasting.