GetNPUsers.py

What it does

GetNPUsers.py finds Active Directory accounts that don't require Kerberos pre-authentication and extracts their AS-REP hashes for offline cracking. It's a common first foothold in a domain.

Common use cases

• •Identify accounts without pre-authentication enabled for AS-REP roasting attack.
• •Gather crackable Kerberos AS-REP hashes from a domain controller without valid credentials.
• •Build user enumeration data by observing Kerberos error messages for valid vs invalid accounts.

Key features

• •Extracts AS-REP hashes from accounts configured without Kerberos pre-authentication.
• •Works without any credentials when targeting accounts with UF_DONT_REQUIRE_PREAUTH set.
• •Outputs hashes in Hashcat and John-the-Ripper compatible formats for offline cracking.

Source