TimeRoast

In AD environments, the DC hashes NTP responses with the computer account NT hash. That means that you can request and brute force all computer accounts in a domain from an UNAUTHENTICATED perspective!

https://www.secura.com/uploads/whitepapers/Secura-WP-Timeroasting-v3.pdfwww.secura.com

https://snovvcrash.rocks/2024/12/08/applicability-of-the-timeroasting-attack.htmlsnovvcrash.rocks

Timeroast

GitHub - SecuraBV/Timeroast: Timeroasting scripts by Tom TervoortGitHub

NXC

nxc smb IP -M timeroast

Cracking

Use extra-scripts/timecrack.py from SecuraBV Timeroast tool

Or: Hashcat will add support for Timeroast hashes as hash type 31300. Currently, it's already available in the beta release.

TargetedTimeroast

GitHub - OffsecDeer/TargetedTimeroast: Tamper Active Directory user attributes to collect their hashes with MS-SNTPGitHub

Targeted Timeroasting: Stealing User Hashes With NTPMedium