# Kerberoast Lab (CTF challenge)

> You Kerberoasted a service account (svc_sql, SPN MSSQLSvc/db01.corp.local:1433) on an AD engagement and pulled its TGS-REP hash.

Canonical: https://codelivly.com/ctf/challenges/kerberoast-lab

| | |
|---|---|
| Category | Active Directory |
| Difficulty | Hard |
| Points | 2500 |
| Estimated time | 1 h |
| Type | Live instance |
| Solves | 9 |
| Author | Codelivly |

You Kerberoasted a service account (svc_sql, SPN MSSQLSvc/db01.corp.local:1433) on an AD engagement and pulled its TGS-REP hash. Crack it offline to recover the weak service-account password, then loot the admin credential (the flag). The hash is a real RC4-HMAC $krb5tgs$23$ (hashcat mode 13100); a wordlist is provided. The password is unique to your instance.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)