Pearson's OSCP Notebook

Kerberos Setup - krb5.conf

Properties2
tagskrb5.conf, kerberos-setup, generate-krb5-file, krb5, nxc, kinit, gettgt, clock-skew, active-directory
aliaseskrb5 setup, Kerberos setup

4 min read

Kerberos Setup — krb5.conf (Linux / Kali)

Ctrl+F: krb5.conf · generate-krb5-file · Cannot find KDC · default_realm · ntpdate · -k

Before -k, impacket-getTGT, kinit, certipy-ad find -k, or bloodyAD -k work from Kali, you need:

  1. /etc/hosts — DC hostname → IP
  2. /etc/krb5.conf — realm + KDC (this file)
  3. Time sync — within 5 min of DC → Time Sync-Clock Skew

Order: hosts → krb5.conf → ntpdate → Kerberos auth.

📌 Why this matters

SymptomOften missing
Cannot find KDC for realmkrb5.conf or /etc/hosts
Clock skew too great / KRB_AP_ERR_SKEWTime sync — not krb5.conf
NTLM works but -k failskrb5.conf + FQDN target + time
impacket-getTGT silent fail-dc-ip + krb5.conf + time

Some labs (e.g. voleur.htb) require Kerberos instead of NTLM for SMB — -k after this setup.

Rubeus runs on Windows and usually does not need Kali krb5.conf — Linux tools do.

📌 Full setup checklist (voleur.htb pattern)

Step 1 — /etc/hosts (FQDN resolution)

# DC + domain hosts — match your lab
echo '10.10.11.76  dc.voleur.htb voleur.htb' | sudo tee -a /etc/hosts

Use hostname as nxc/Impacket target when using -k: DC.voleur.htb not bare IP.

Pair with --generate-hosts-file → CrackMapExec - nxc > 📌 Generate hosts file

Step 2 — Generate krb5.conf with nxc

nxc smb DC.voleur.htb -u 'ryan.naylor' -p 'HollowOct31Nyt' -d voleur.htb -k \
  --generate-krb5-file voleur.krb5

Creates a template with correct realm, KDC, and domain_realm mappings for the domain.

Inspect:

cat voleur.krb5

Step 3 — Install as system krb5.conf

Preferred — copy generated file:

cat voleur.krb5 | sudo tee /etc/krb5.conf

Manual (same content — realm UPPERCASE):

sudo tee /etc/krb5.conf <<'EOF'
[libdefaults]
    dns_lookup_kdc = false
    dns_lookup_realm = false
    default_realm = VOLEUR.HTB
 
[realms]
    VOLEUR.HTB = {
        kdc = dc.voleur.htb
        admin_server = dc.voleur.htb
        default_domain = voleur.htb
    }
 
[domain_realm]
    .voleur.htb = VOLEUR.HTB
    voleur.htb = VOLEUR.HTB
EOF
SectionPurpose
[libdefaults]Default realm for all Kerberos clients
[realms]KDC hostname/IP per realm
[domain_realm]Maps *.voleur.htb DNS names → realm

Per-lab without overwriting: export KRB5_CONFIG=/path/to/voleur.krb5

Step 4 — Sync time to DC (required)

sudo timedatectl set-ntp false
sudo ntpdate 10.10.11.76
# or: sudo ntpdate -s dc.voleur.htb
sudo ntpdate -q 10.10.11.76    # offset should be ~0
date

Full troubleshooting → Time Sync-Clock Skew

Step 5 — Verify Kerberos auth works

# nxc — Kerberos instead of NTLM
nxc smb DC.voleur.htb -u ryan.naylor -p 'HollowOct31Nyt' -d voleur.htb -k --shares
 
# Impacket TGT
impacket-getTGT voleur.htb/ryan.naylor:'HollowOct31Nyt' -dc-ip 10.10.11.76
export KRB5CCNAME=ryan.naylor.ccache
impacket-secretsdump -k -no-pass voleur.htb/ryan.naylor@DC.voleur.htb -dc-ip 10.10.11.76
 
# Native krb5-user
kinit ryan.naylor@VOLEUR.HTB
klist

→ CrackMapExec - nxc > 📌 4b) Kerberos authentication (-k) · Kerberos Scripts > getTGT · Use Kerberos Ticket

📌 When to use this workflow

SituationUse krb5 setup?
Lab requires -k / Kerberos-only SMBYes — voleur-style
impacket-getTGT / -k -no-pass ImpacketYes
certipy-ad find -k -no-passYes + Time Sync-Clock Skew
bloodyAD -kYes
Simple NTLM only (user:pass@IP)Optional — -dc-ip may be enough for some scripts
Rubeus on Windows shellNo Kali krb5.conf needed

📌 Tools that depend on this setup

ToolKerberos flag / usage
CrackMapExec - nxc-k · --use-kcache · --generate-krb5-file
Kerberos ScriptsgetTGT · GetUserSPNs -k · GetNPUsers
Use Kerberos TicketKRB5CCNAME + -k -no-pass
krb5-userkinit user@REALM
bloodyAD-k
Certipy & Certifyfind -k -no-pass
secretsdump-k -no-pass DCSync
Shadow Credentials - pywhiskerPKINIT after pywhisker

Always pair with Time Sync-Clock Skew.

📌 Troubleshooting

ErrorFix
Cannot find KDC for realm "VOLEUR.HTB"Fix krb5.conf + /etc/hosts for dc.voleur.htb
Clock skew too greatTime Sync-Clock Skew — timedatectl set-ntp false → ntpdate
-k still uses NTLM / failsTarget must be FQDN; -d domain.htb; krb5.conf installed
Wrong realm caseRealm = UPPERCASE (VOLEUR.HTB), domain = lowercase in [domain_realm]
Multiple labsexport KRB5_CONFIG=~/labs/voleur.krb5 per domain
kinit works, Impacket failsexport KRB5CCNAME=$(klist | grep 'Ticket cache' | awk '{print $3}')
-k / psexec fails with valid ccacheUse Kerberos Ticket > 📌 7) Worked example — KRB5CCNAME + /etc/hosts + psexec — FQDN in /etc/hosts + export KRB5CCNAME

📌 Quick cheat sheet

# 1. Hosts
echo 'DC_IP  dc.domain.htb domain.htb' | sudo tee -a /etc/hosts
 
# 2. krb5.conf
nxc smb DC.domain.htb -u 'user' -p 'PASS' -d domain.htb -k --generate-krb5-file domain.krb5
cat domain.krb5 | sudo tee /etc/krb5.conf
 
# 3. Time
sudo timedatectl set-ntp false && sudo ntpdate DC_IP
 
# 4. Test
nxc smb DC.domain.htb -u user -p 'PASS' -d domain.htb -k --shares
impacket-getTGT domain.htb/user:'PASS' -dc-ip DC_IP

Graph View

Backlinks