repository·main·Indexed 43 days ago
https://github.com/skelsec/minikerberosA Python-based Kerberos client library for programmatic integration and security auditing. It supports synchronous and asynchronous APIs, authentication via password, AES, RC4 LTK, and PKINIT, and provides tools for TGT/TGS requests, S4U2self/S4U2proxy constrained delegation, and User-to-User (U2U) authentication. It serves as a core dependency for pypykatz, aiosmb, and msldap.
The minikerberos library provides both asynchronous and blocking versions of the Kerberos client. Both versions share the same API, allowing developers to choose the concurrency model that fits their application without changing the method calls.
Supported authentication methods include:
pfx or pem formatted certificates, or certificates from the Windows certificate store)You can install minikerberos using pip from PyPI or by cloning the repository and running the setup script. It is recommended to use a Python virtual environment.
Requirements:
# Via pip
$ pip install minikerberos --user
# Via GitHub clone
$ git clone https://github.com/skelsec/minikerberos.git
$ cd minikerberos
$ python3 setup.py installpip, minikerberos automatically installs several command-line tools into your Scripts directory. These tools follow the naming convention minikerberos-<toolname> and are designed for security auditing and pentesting activities.The following command-line tools are provided for various Kerberos-related security tasks:
minikerberos-getTGT: Fetches a TGT for the given kerberos credential (must be in standard kerberos URL format).
minikerberos-getTGS: Fetches a TGS ticket (TGSREP) for a given credential and SPN (format: service/hostname@FQDN).
minikerberos-kerberoast: Performs a kerberoast attack (SPNRoast) against one or multiple users using provided credentials.
minikerberos-getNTPKInit: Recovers the NT hash for a user via PKINIT (certificate-based auth).
minikerberos-kerb23hashdecrypt: Attempts to recover a user's NT hash for a list of kerberoast hashes by checking if the NT hash can decrypt the ticket.
minikerberos-getS4U2self: Impersonates users using machine account credentials (machine account in kerberos URL format, user in UserPrincipalName format).
minikerberos-getS4U2proxy: Used for Kerberos Resource-based Constrained Delegation (RBCD) impersonation. Requires machine account to be allowed to delegate on all protocols.
minikerberos-ccacheroast: Performs a Kerberoast attack on a CCACHE file to retrieve TGS ticket "hashes".
minikerberos-ccache2kirbi: Converts a CCACHE file to a list of .kirbi files.
minikerberos-kirbi2ccache: Converts one or more .kirbi files into one CCACHE file.
minikerberos-ccacheedit: Command-line CCACHE file editor to list or delete credentials.The U2U() method implements the User-to-User Kerberos authentication protocol. This is used when two users want to establish a secure channel without involving a service principal, typically using the TGT to request a TGS for the other user.
Returns: (tgs, encTGSRepPart, key, decticket) where decticket is the decrypted ticket content.
tgs, enc_part, key, dec_ticket = client.U2U()Use get_TGT() to authenticate the user and obtain a TGT. This method automatically handles pre-authentication: it first attempts to request a TGT without authentication data to check for 'no-preauth' vulnerabilities, and if pre-authentication is required, it performs the necessary pre-auth steps (either via standard password-based build_asreq_lts or certificate-based build_asreq_pkinit).
Parameters:
override_etype (optional): A list of integer encryption type values to override the default supported types.decrypt_tgt (bool): If False, the method returns the TGT without attempting to decrypt it (useful for AS-REP Roasting attacks).kdcopts (list of str): Kerberos options like ['forwardable', 'renewable', 'proxiable'].override_sname (KerberosSPN, optional): Allows requesting a TGT for a specific service instead of the default krbtgt (useful for Kerberoasting).with_pac (bool): Whether to include the Privilege Attribute Certificate (PAC) in the request.client.get_TGT(decrypt_tgt=True, kdcopts=['forwardable', 'renewable'])
# For AS-REP Roasting (don't decrypt the TGT)
client.get_TGT(decrypt_tgt=False)
# For Kerberoasting (requesting a specific service instead of krbtgt)
from minikerberos.common.spn import KerberosSPN
service_spn = KerberosSPN('service/host.domain.com')
client.get_TGT(override_sname=service_spn)Use get_TGS() to request a Ticket Granting Service (TGS) ticket for a specific service principal. This method requires an existing TGT (either in the client's memory or loaded from the CCACHE).
Parameters:
spn_user (KerberosTarget): The target service user/principal you want to get a ticket for.override_etype (optional): A list of integer encryption type values. This is frequently used in Kerberoasting to force the KDC to return a ticket with a weaker encryption type (e.g., RC4).is_linux (bool): If True, includes specific checksum/channel binding data required for Linux environments.from minikerberos.common.target import KerberosTarget
service_target = KerberosTarget(username='service/host.domain.com', domain='DOMAIN.COM')
tgs, enc_part, key = client.get_TGS(service_target, override_etype=[23]) # Requesting RC4 for KerberoastingOnce you have a TGS ticket and its encrypted part, use construct_apreq() to build the AP_REQ structure required to actually authenticate to the target service.
Parameters:
tgs: The TGS response object.encTGSRepPart: The decrypted enc-part from the TGS response.sessionkey: The session key extracted from the TGS response.flags, seq_number, ap_opts, cb_data: Optional parameters for advanced AP_REQ construction.ap_req = client.construct_apreq(tgs, enc_part, session_key)The KerberosClient class is the primary entry point for interacting with a Kerberos KDC. It requires a KerberosCredential object (containing user credentials and potentially certificates/DH parameters) and a KerberosTarget object (representing the KDC/domain). It manages the network socket, credential cache (CCACHE), and session keys/tickets.
from minikerberos.client import KerberosClient
from minikerberos.common.creds import KerberosCredential
from minikerberos.common.target import KerberosTarget
# Assuming ccred and target are already instantiated
client = KerberosClient(ccred, target)The client supports Service-for-User (S4U) extensions for impersonation.
Used by a service to obtain a service ticket to itself on behalf of a user. This allows a service to impersonate a user without knowing their password.
user_to_impersonate (KerberosTarget), spn_user (optional, can be string or KerberosTarget).Used to extend an existing service ticket (obtained via S4U2self) to a different service. This is the core of constrained delegation.
s4uself_ticket (the ticket from S4U2self), spn_user (the target service principal).Convenience method that performs both S4U2self and S4U2proxy to return a final service ticket for a target user and service.
from minikerberos.common.target import KerberosTarget
target_user = KerberosTarget(username='user', domain='DOMAIN.COM')
service_spn = KerberosTarget(username='service/host.domain.com', domain='DOMAIN.COM')
# Get a service ticket for the target user at the target service via S4U
st = client.getST(target_user, service_spn)