Kerberoast

The kerberoast command will perform an ASREQ to fetch a kerberos ticket for a valid SPN and return the KRB5 encoded ticket. You can specify any number of SPNs to this command and it will fetch the tickets recursively for all of them. The SPN name has to be in the format of name/host.

This ticket can be decoded and converted to the hashcat format using krb5decoder which is a part of the BRc4 package starting from release v1.0.