RODC Key List Attack

Use the RODC-specific krbtgt secret and RODC number to make Kerberos Key List requests through an RODC-signed TGT. The request can return a targeted principal's long-term keys, including its NT hash, when that principal is permitted by the RODC Password Replication Policy; the principal need not already be cached. Choose one complete Impacket entry point (step 1 or 2), or use the Rubeus flow in steps 3–4; these are alternative implementations, not four sequential actions. The Rubeus path requires a reachable writable domain controller and a target permitted by the RODC policy.