domains / families / security / exploiting-kerberoasting-with-impacket

exploiting-kerberoasting-with-impacket

separate

Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.

When to use

• When performing authorized security testing that involves exploiting kerberoasting with impacket
• When analyzing malware samples or attack artifacts in a controlled environment
• When conducting red team exercises or penetration testing engagements
• When building detection capabilities based on offensive technique understanding

When not to use

• unauthorized use against systems you do not own
• use without written permission to test

Skill page

Source