Una publicación etiquetados con "Active Directory"

Short answer: Kerberoasting abuses a normal Kerberos feature — any authenticated domain user can request a service ticket for any service account, and part of that ticket is encrypted with the account's password hash. The attacker requests tickets, takes them offline, and cracks the weak ones. No exploit, no privilege required, and it still works in most domains.