WAD · Tool
Impacket's GetUserSPNs.py will attempt to fetch Service Principal Names that are associated with normal user accounts. What is returned is a ticket that is encrypted with the user account's password, which can then be bruteforced offline. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Password: password123
GetUserSPNs.py with -no-preauth performs Kerberoasting without any valid domain credentials. It leverages an account that has Kerberos pre-authentication disabled (an AS-REP roastable account): by altering the sname in a crafted KRB_AS_REQ, the KDC returns a service ticket instead of a TGT, encrypted with the target service account's key. Because you cannot query LDAP for SPNs without creds, you must supply candidate service-account names with -usersfile. The resulting TGS hashes are cracked offline. You only need the name of one pre-auth-disabled account plus a list of accounts to roast. Command Reference: No_Creds (name of an AS-REP roastable account: john) Candidate accounts file: usernames.txt Domain: test.local Domain Controller host: dc.test.local