Targeted Kerberoasting
The above technique can be used if we have any of the below access rights over the target.
The rights GenericWrite, WriteProperty or Validated-SPN over the target.
Below an explanation from the repository.
... for each user without SPNs, it tries to set one (abuse of a write permission on the servicePrincipalName attribute), print the "kerberoast" hash, and delete the temporary SPN set for that operation. This is called targeted Kerberoasting.
python3 ~/tools/ad/targetedKerberoast/targetedKerberoast.py -v -d 'offsec.local' -u 'controlledUser' -p 'password'
Last updated