kerbrute

You can install Kerbrute using pre-compiled binaries, via Go, or by compiling from source using make.

Using Go

go get github.com/ropnop/kerbrute

Compiling from source

If you have the repository cloned, use the make command to build binaries for different architectures:

• make windows: Build Windows x86 and x64 binaries.
• make linux: Build Linux x86 and x64 binaries.
• make mac: Build Darwin (Mac) x86 and x64 binaries.
• make all: Build binaries for Windows, Linux, and Mac x86/x64.

The bruteforce command reads username:password combinations from a file or stdin and tests them via Kerberos Pre-Authentication. It skips blank lines or lines with missing components.

WARNING: This generates Windows event IDs 4768 and 4771.

Required Flags:

• -d, --domain <string>: The full domain to use.

Example (using stdin):

cat combos.lst | ./kerbrute -d lab.ropnop.com bruteforce -

The passwordspray command performs a horizontal brute force attack by testing a single password against a list of domain users.

WARNING: This will increment failed login counts and can lock out accounts. It generates Windows event IDs 4768 and 4771.

Required Flags:

• -d, --domain <string>: The full domain to use.

Example:

./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123

The bruteuser command performs a traditional brute force attack against a specific username using a password wordlist.

WARNING: Only run this if you are certain there is no lockout policy in place. This generates Windows event IDs 4768 and 4771.

Required Flags:

• -d, --domain <string>: The full domain to use.

Example:

./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman

The userenum command identifies valid domain usernames by sending TGT requests without pre-authentication. If the KDC prompts for pre-authentication, the username is valid. This method does not cause login failures and will not lock out accounts.

Required Flags:

• -d, --domain <string>: The full domain to use (e.g., contoso.com).

Example:

./kerbrute_linux_amd64 userenum -d lab.ropnop.com usernames.txt

Kerbrute is a tool designed to perform bruteforce attacks against Windows Kerberos to identify valid Active Directory accounts via Kerberos Pre-Authentication.

Warning: Failed Kerberos Pre-Auth attempts count as failed logins and will lock out accounts. Use the --safe flag to mitigate this risk.

Common flags available across Kerbrute commands:

The following flags are available globally for all Kerbrute commands:

When using the passwordspray command, you can use the following flag to modify the spray behavior:

• --user-as-pass: If set, the tool will spray every account using the username itself as the password. When using this flag, you do not need to provide a second argument for the password.

The passwordspray command performs a password spray attack against a list of users using Kerberos Pre-Authentication by requesting a TGT from the KDC. If no domain controller is specified, the tool attempts to look one up via DNS SRV records. A full domain is required and will be capitalized to serve as the Kerberos realm.

WARNING: Use with caution; failed Kerberos pre-authentication can cause account lockouts.

Successful logins are displayed on stdout.

The bruteuser command performs a password bruteforce against a single domain user using Kerberos Pre-Authentication by requesting a TGT from the KDC.

Key Behaviors:

• If no domain controller is specified, the tool attempts to look one up via DNS SRV records.
• A full domain is required; the tool will capitalize this domain and use it as the Kerberos realm.
• WARNING: Only run this if there is no account lockout policy in place, as it will attempt every password in the provided list.
• The command supports reading passwords from a file or from stdin (using -).