About

Imported from mukul975/anthropic-cybersecurity-skills (skills/performing-kerberoasting-attack/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill performing-kerberoasting-attack. Copyright stays with the author (Apache-2.0).

Performing Kerberoasting Attack

Name: performing-kerberoasting-attack
Author: mukul975

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs) set. These tickets are encrypted with the service account's NTLM hash, allowing offline brute-force cracking without generating failed login events. It is one of the most common privilege escalation paths in AD environments because any domain user can request TGS tickets.

When to Use

When conducting security assessments that involve performing kerberoasting attack
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

MITRE ATT&CK Mapping

T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
T1087.002 - Account Discovery: Domain Account
T1069.002 - Permission Groups Discovery: Domain Groups

Workflow

Phase 1: SPN Enumeration

Enumerate accounts with SPNs using LDAP queries
Filter for user accounts (not computer accounts)
Identify accounts with elevated privileges (adminCount=1)
Prioritize accounts with weak password policies

Phase 2: TGS Ticket Request

Request TGS tickets for identified SPN accounts
Extract ticket data in crackable format (hashcat/john compatible)
Ensure RC4 encryption is requested when possible (easier to crack)
Document all requested tickets

Phase 3: Offline Cracking

Use hashcat mode 13100 (Kerberos 5 TGS-REP etype 23) for RC4 tickets
Use hashcat mode 19700 (Kerberos 5 TGS-REP etype 17) for AES-128
Use hashcat mode 19800 (Kerberos 5 TGS-REP etype 18) for AES-256
Apply targeted wordlists and rules based on password policy

Phase 4: Credential Validation

Validate cracked credentials against domain
Assess access level of compromised accounts
Map accounts to BloodHound attack paths
Document for engagement report

Tools and Resources

Tool	Purpose	Platform
Rubeus	Kerberoasting and ticket manipulation	Windows (.NET)
Impacket GetUserSPNs.py	Remote Kerberoasting	Linux/Python
PowerView	SPN enumeration	Windows (PowerShell)
hashcat	Offline password cracking	Cross-platform
John the Ripper	Offline password cracking	Cross-platform

Detection Indicators

Event ID 4769: Kerberos Service Ticket Request with RC4 encryption (0x17)
Anomalous TGS requests from a single account in short timeframe
TGS requests for services the user normally does not access
Honeypot SPN accounts with alerting on ticket requests

Validation Criteria

SPN accounts enumerated and documented
TGS tickets extracted in crackable format
Offline cracking attempted with appropriate wordlists
Cracked credentials validated
Access level of compromised accounts assessed

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-performing-kerbe-b77827/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-performing-kerbe-b77827.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-performing-kerbe-b77827",
  "kind": "skill",
  "name": "performing-kerberoasting-attack",
  "description": "Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service Principal Names (SPNs), requests their Kerberos TGS tickets, and cracks the NTLM-encrypted tickets offline to recover service account credentials. Use during authorized red team engagements or penetration tests to assess AD privilege escalation and credential access risk from weak service account passwords.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "red-team",
      "adversary-simulation",
      "mitre-attack",
      "exploitation",
      "post-exploitation",
      "kerberoasting",
      "active-directory",
      "credential-access",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service Principal Names (SPNs), requests their Kerberos TGS tickets, and cracks the NTLM-encrypted tickets offline to recover service account credentials. Use during authorized red team engagements or penetration tests to assess AD privilege escalation and credential access risk from weak service account passwords."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/performing-kerberoasting-attack/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/performing-kerberoasting-attack/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/performing-kerberoasting-attack/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Performing Kerberoasting Attack\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nKerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs) set. These tickets are encrypted with the service account's NTLM hash, allowing offline brute-force cracking withou",
  "cost": {
    "context_tokens": 867
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-performing-kerbe-b77827/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.