| name | exploiting-kerberoasting-with-impacket |
| description | Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["kerberoasting","impacket","active-directory","credential-access","kerberos","t1558-003","service-accounts"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Exploiting Kerberoasting with Impacket
Overview
Kerberoasting (MITRE ATT&CK T1558.003) is a credential access technique that targets Active Directory service accounts by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs). The TGS ticket is encrypted with the service account's NTLM hash (RC4 or AES), enabling offline brute-force cracking. Impacket's GetUserSPNs.py is the standard tool for Linux-based Kerberoasting attacks.
When to Use
- When performing authorized security testing that involves exploiting kerberoasting with impacket
- When analyzing malware samples or attack artifacts in a controlled environment
- When conducting red team exercises or penetration testing engagements
- When building detection capabilities based on offensive technique understanding
Most Often Missed & How to Confirm
- Roasting accounts you can't crack. A
$krb5tgs$ hash is only a win if the password is weak. gMSA/managed accounts (240-char random) won't crack — triage by PasswordLastSet age and prioritize stale, human-set service passwords.
- Defaulting to AES tickets. If the account supports AES you'll get mode 19700 (far slower to crack). Use Rubeus
/tgtdeleg or downgrade tactics to pull crackable RC4 (etype 0x17, hashcat -m 13100) where the account allows it.
- Mangled hash files. Line wrapping from
GetUserSPNs.py output breaks hashcat; keep one hash per line.
- Targeting
krbtgt (not roastable) or ignoring AdminCount=1 / Domain Admin SPN holders that give the highest payoff.
- How to confirm a hit: the success signal is a cracked plaintext —
hashcat -m 13100 <file> --show prints ...:Summer2024!. Then prove it's usable: crackmapexec smb <dc> -u svc_sql -p 'Summer2024!' returns [+], and if the account is privileged secretsdump.py corp.local/svc_sql:'...'@dc -just-dc-ntlm runs. Don't conclude an account is "uncrackable" until you've requested an RC4 ticket (not just AES) and run it against a real wordlist + rules; an unbroken AES hash is not proof of a strong password.
Prerequisites
- Valid domain credentials (any domain user can request TGS tickets)
- Network access to a Domain Controller (TCP/88 Kerberos, TCP/389 LDAP)
- Impacket installed (
pip install impacket)
