Kerberoast

PsMapExec will now perform kerberoasting. By default, all kerberoastable users are obtained and written to file. All hashes are output to file and split into each file depending on the associated encryption.

Output is stored in: $PWD\PME\Kerberoast

Optional Parameters

Parameter	Value	Description
-Domain	Domain	Set the Domain for which to run against
-Option	Kerberoast:USER	Specify a single user to roast than than all candidate users
-ShowOutput	N/A	Displays hash output to the console

Obtain all Kerberoastable users from target domain

PsMapExec -Method kerberoast -Domain north.sevenkingdoms.local

Single user specification

PsMapExec -Method Kerberoast -ShowOutput -Option Kerberoast:USER