What problem does it solve?
During authorized Active Directory assessments, testers need a structured methodology to attack the Kerberos service (port 88) — enumerating users, roasting accounts, and authenticating in Kerberos-only environments — without missing critical checks like clock skew or pre-auth misconfigurations.
Core Features & Use Cases
- Username Enumeration: Validate domain users without credentials using kerbrute and the nmap krb5-enum-users script.
- AS-REP Roasting & Kerberoasting: Extract crackable $krb5asrep$ and $krb5tgs$ hashes with Impacket's GetNPUsers.py and GetUserSPNs.py, then crack them offline with hashcat.
- Kerberos-Only Authentication: Generate krb5.conf, sync clock skew, and acquire TGTs via kinit when NTLM is disabled.
- Use Case: On an engagement where port 88 is open on a domain controller, enumerate valid usernames, AS-REP roast an account with pre-auth disabled, crack the hash offline, and use the recovered credential for initial domain access.
Quick Start
Test the Kerberos service on the domain controller at 10.0.0.5 for the domain corp.local, starting with username enumeration and AS-REP roasting checks.
