exploiting-kerberoasting-with-impacket

name	exploiting-kerberoasting-with-impacket
description	Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.
domain	cybersecurity
subdomain	red-teaming
tags	["kerberoasting","impacket","active-directory","credential-access","kerberos","t1558-003","service-accounts"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]
mitre_attack	["T1595","T1190","T1059","T1078","T1003"]

Exploiting Kerberoasting with Impacket

Overview

Kerberoasting (MITRE ATT&CK T1558.003) is a credential access technique that targets Active Directory service accounts by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs). The TGS ticket is encrypted with the service account's NTLM hash (RC4 or AES), enabling offline brute-force cracking. Impacket's GetUserSPNs.py is the standard tool for Linux-based Kerberoasting attacks.

When to Use

• When performing authorized security testing that involves exploiting kerberoasting with impacket
• When analyzing malware samples or attack artifacts in a controlled environment
• When conducting red team exercises or penetration testing engagements
• When building detection capabilities based on offensive technique understanding

Prerequisites

• Valid domain credentials (any domain user can request TGS tickets)
• Network access to a Domain Controller (TCP/88 Kerberos, TCP/389 LDAP)
• Impacket installed (pip install impacket)
• Hashcat or John the Ripper for offline cracking
• Wordlist (e.g., rockyou.txt, SecLists)

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

MITRE ATT&CK Mapping

Technique ID	Name	Tactic
T1558.003	Steal or Forge Kerberos Tickets: Kerberoasting	Credential Access
T1087.002	Account Discovery: Domain Account	Discovery
T1110.002	Brute Force: Password Cracking	Credential Access

Step 1: Enumerate Kerberoastable Accounts

# List all user accounts with SPNs (without requesting tickets)
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1

# Output example:
# ServicePrincipalName          Name        MemberOf                          PasswordLastSet
# ----------------------------  ----------  --------------------------------  -------------------
# MSSQLSvc/SQL01.corp.local     svc_sql     CN=Domain Admins,CN=Users,...     2023-01-15 10:30:22