Kerberos — Concepts & OSCP
What is Kerberos?
Default authentication for Active Directory. Uses tickets instead of sending passwords on every request.
User + password → AS (KDC) → TGT (Ticket-Granting Ticket)
TGT + SPN request → TGS (service ticket) → Access service
| Port | Service |
|---|---|
| 88/tcp/udp | Kerberos KDC |
| 464/tcp/udp | kpasswd — password change → Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE · krb5-user |
| 646/tcp/udp | LDP (MPLS) — network gear; not AD kpasswd (see UseCases for ports > Port 646 — LDP (Label Distribution Protocol)) |
Deep tool workflows: Kerberoast, Kerberos Scripts, Rubeus, Kerbrute.
📌 0) Kerberos prerequisites (Linux)
1. [[Kerberos Setup - krb5.conf]] — /etc/hosts + krb5.conf (nxc --generate-krb5-file)
2. [[Time Sync]] — ntpdate -s DC_IP (±5 min)
3. Auth — getTGT / kinit / nxc -k📌 0b) Time Sync — Do This First
Kerberos fails if attacker clock is >5 minutes off the DC.
sudo timedatectl set-ntp false # stop internet NTP first
sudo ntpdate -s DC_IPFull reference → Time Sync
Symptoms: KRB_AP_ERR_SKEW, “Clock skew too great”
📌 Ticket Types
| Ticket | Purpose |
|---|---|
| TGT | Proves identity to KDC — get from AS with password/hash |
| TGS | Access specific service (CIFS, HTTP, LDAP…) |
| Silver | Forged TGS (service hash) |
| Golden | Forged TGT (krbtgt hash) |
📌 Common Attacks (OSCP)
| Attack | Needs | Tool |
|---|---|---|
| AS-REP roast | User list, no preauth | GetNPUsers, Rubeus asreproast |
| Kerberoast | Any domain user | GetUserSPNs, Rubeus kerberoast |
| Pass-the-Ticket | Stolen .ccache / ticket | export KRB5CCNAME, -k Impacket |
| Pass-the-Hash (Kerberos) | NT hash | getTGT -hashes |
| Overpass-the-hash (AES) | AES256/AES128 key from dump | getTGT -aesKey |
| Golden/Silver ticket | krbtgt or service hash | ticketer, Rubeus |
See Kerberoast, Kerberos Scripts.
📌 Linux Attack Flow
1. [[Kerberos Setup - krb5.conf]] — hosts + krb5.conf
2. [[Time Sync]] — ntpdate -s DC_IP
3. [[Kerbrute]] userenum / passwordspray
3. NT_STATUS_PASSWORD_MUST_CHANGE? → [[Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE]] · kpasswd / smbpasswd
4. AS-REP or Kerberoast → [[Hashcat]]
5. getTGT → export KRB5CCNAME → Impacket -k
6. [[Bloodhound + Sharphound]] for paths