Honestly, all my code is basically archeology at this point.
Cracker: Hashcat
Extract: Mimikatz, Rubeus, loads of other
Request: Rubeus, Invoke-Kerberoast, loads of others

Others have done it better. Use their tools
A thread...
1/n https://twitter.com/TimMedin/status/1249790336328753154

I don't know of another tool that extracts tickets from a pcap, but there are probably a better tools than mine.
It's beautiful to see a concept I was lucky enough to land on see the development and progress we've seen.
2/n

I regularly watch other people's talks on Kerberoasting. If you give a talk on it (even cursory) I try to attend or watch it later. I learn a lot on how to explain it, different nuances I didn't think of, and cool new attacks.
3/n

People expect me to be an expert on all things Kerberoast. I'm not 100% sure I can say that anymore. People like @harmj0y, @elitest and others (I feel terrible not mentioning here because my memory sucks) continue to evolve this way beyond what I imagined or can understand.
4/n

Morning of my DerbyCon Kerberoast talk, @gentilkiwi released code that did silver ticket better than what I was about to do in 7hrs. I was bummed at first, but I got to work with him, troubleshoot and test his new code (btw, during testing I accidentally sent him my krbtgt).
5/n

He even offered to pull his code down until after my talk (I declined). I learned a valuable lesson from him about being humble and accepting other people's help and work. He did later send me a custom compiled mimikatz with my name it. I run it from time to time and smile.
6/n

When people want to learn Kerberoasting, I point them at @PyroTek3's blog ( https://adsecurity.org/?p=2011 ) since it explains it more thoroughly than I did. There's no need to re-invent the wheel when someone else does it better. Give them credit and move on.
7/n

In short, accept and embrace other people's work. We have lots of very sharp people in this industry. All of those sharp people that I've met have been extremely humble and friendly. If they are jerks, they usually are hiding their ignorance and you can safely ignore them.
8/n

You don't need to come up with some new technique on the ATT&CK framework. Take something that already out there and make it better, faster, easier. Blog and talk about things that already exist but put your spin on it.
9/n

I'm thankful for those who took this idea and ran with it.
Thank you all for using Kerberoasting. I'm honored.
Thanks, Tim
<fin>