Kerbrute
Kerberos answers differently depending on whether the user exists, so Kerbrute validates usernames without credentials and without the usual failed-logon events. If a user has pre-authentication disabled, it also gives you their AS-REP hash.
- Platform
- Linux · Windows · macOS (Go)
- Official site
- github.com/ropnop/kerbrute
- On HTB
- 13 machines
Install
go install github.com/ropnop/kerbrute@latest- T1087.002 Domain Account
- T1110.003 Password Spraying
- Domain LDAP/RPC enumeration
- Password spraying and valid users
- AS-REP roasting
Kerbrute cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Spraying
One password against every user
kerbrute passwordspray -d box.htb --dc 10.10.11.20 usuarios.txt 'Password123!'
Several passwords against one user
kerbrute bruteuser -d box.htb --dc 10.10.11.20 claves.txt usuarioMind the account lockout policy.
In our cheatsheets
Windows and Active Directory privilege escalation › Active Directory
Validate users (Kerberos)
kerbrute userenum -d box.htb --dc 10.10.11.20 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txtNo command matches.
HTB machines where Kerbrute is used
Taken from the chapters of IppSec videos where Kerbrute shows up. The ▶ link jumps to the minute of that part.
Guides that use Kerbrute
- Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory 3 min read What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).
- Active Directory enumeration: users, LDAP, BloodHound and password spraying 4 min read What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.