pentesting-kerberos

name	pentesting-kerberos
description	Testing the Kerberos authentication service (88/tcp and 88/udp) in Active Directory during authorized engagements. Covers username enumeration (kerbrute, nmap krb5-enum-users), AS-REP roasting of accounts without pre-auth, Kerberoasting service accounts (GetUserSPNs), password spraying, TGT acquisition (kinit) for Kerberos-only environments, krb5.conf generation, clock-skew handling, and MS14-068 ticket forgery.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","kerberos","active-directory","as-rep-roast","kerberoast"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting Kerberos (port 88)

When to Use

• During authorized Active Directory assessments when TCP/UDP 88 is open (a domain controller)
• When you need to enumerate valid usernames without authentication
• When testing for AS-REP roastable accounts (no Kerberos pre-auth) and Kerberoastable service accounts
• When NTLM is disabled and you must authenticate to SMB/WinRM/etc. via Kerberos (ccache TGT)
• When validating credentials via password spraying with low lockout risk

Quick Enumeration

# Confirm Kerberos / identify the DC
nmap -p88 -sV <IP>
# Expected: 88/tcp open kerberos-sec

# Username enumeration (no creds) — AS-REQ probing
nmap -p88 --script krb5-enum-users \
  --script-args krb5-enum-users.realm='DOMAIN.LOCAL',userdb=users.txt <IP>

kerbrute userenum -d domain.local --dc <DC_IP> users.txt

# Shodan-style discovery
# port:88 kerberos

Critical: Checks Most Often Missed

1. AS-REP roasting (no pre-auth) — accounts with DONT_REQ_PREAUTH set return an AS-REP encrypted with the user's key, crackable offline with no valid creds required.
2. Kerberoasting — any authenticated user can request service tickets (TGS) for accounts with SPNs; the ticket is encrypted with the service account's NTLM hash and crackable offline.
3. Clock skew is mandatory — a host clock off by more than ~5 minutes causes KRB_AP_ERR_SKEW and every Kerberos auth fails silently. Sync to the DC first.
4. NTLM-disabled environments — NTLM attempts return STATUS_NOT_SUPPORTED; you must force Kerberos (-k) with a valid ccache TGT.
5. MS14-068 (KB3011780) — lets an attacker forge a PAC claiming Domain Admin privileges, validated by an unpatched DC. Critical if present.
6. SPN/FQDN mismatch — GSSAPI/Kerberos auth requires the exact FQDN matching the host SPN, or you get "Server not found in Kerberos database." Fix /etc/hosts ordering.

How to CONFIRM: username enumeration is confirmed when kerbrute userenum prints [+] VALID USERNAME. AS-REP roastability is confirmed when GetNPUsers.py returns a $krb5asrep$ hash. Kerberoastability is confirmed when returns a hash.