krb5-user

krb5-user — Kerberos Client (Linux)

Debian/Kali package krb5-user — native Kerberos client tools for AD labs. Use for TGT requests, ticket inspection, and password changes (kpasswd → port 464).

---

Install (Kali)

sudo apt update
sudo apt install -y krb5-user
dpkg-reconfigure krb5-config    # optional — set default realm interactively
which kinit klist kpasswd

Full install index → Installation - Kali Setup

Password-must-change workflow → Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE

Time sync before any Kerberos call → Time Sync-Clock Skew · Time Sync

Full krb5.conf setup (hosts + nxc --generate-krb5-file + install) → Kerberos Setup - krb5.conf

Ctrl+F: kpasswd · kinit · klist · kdestroy · port 464 · smbpasswd · NT_STATUS_PASSWORD_MUST_CHANGE

External: Internal All The Things — Linux

---

Configure /etc/krb5.conf

→ Full lab workflow: Kerberos Setup - krb5.conf (nxc --generate-krb5-file · cat file | sudo tee /etc/krb5.conf · ntpdate)

Quick manual template:

[libdefaults]
    default_realm = CORP.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
 
[realms]
    CORP.LOCAL = {
        kdc = 10.10.10.10
        admin_server = 10.10.10.10
    }
 
[domain_realm]
    .corp.local = CORP.LOCAL
    corp.local = CORP.LOCAL

Realm in principals is UPPERCASE (user@CORP.LOCAL).

---

kinit — get a TGT

Request a Ticket-Granting Ticket from the KDC (port 88).

kinit username@REALM.LOCAL
kinit -V username@REALM.LOCAL          # verbose
 
# Password from stdin (scripting — authorized targets only)
echo 'Password123!' | kinit username@REALM.LOCAL
 
# Lifetime
kinit -l 10h username@REALM.LOCAL
kinit -r 7d username@REALM.LOCAL       # renewable
 
# Keytab (no password prompt)
kinit -k -t /path/to/user.keytab username@REALM.LOCAL

After success, tickets live in default cache (usually /tmp/krb5cc_UID).

Use with Impacket:

kinit user@CORP.LOCAL
export KRB5CCNAME=/tmp/krb5cc_1000
impacket-wmiexec -k -no-pass CORP.LOCAL/user@TARGET -dc-ip DC_IP

---

klist — list tickets

klist
klist -f                              # flags (forwardable, etc.)
klist -c /tmp/krb5cc_1000             # specific cache
klist -k                              # encryption types
klist -A                              # all caches

Empty output = no ticket — run kinit first.

---

kdestroy — remove tickets

kdestroy
kdestroy -A                             # all caches
kdestroy -c /tmp/krb5cc_1000

Use when switching users or before a clean kinit.

---

kpasswd — change password (port 464)

Talks to kpasswd on DC TCP/UDP 464.

kpasswd user@REALM.LOCAL

Example:

kpasswd Caroline.Robinson@BABY.VL

Prompts: current password → new password → confirm.

When: NT_STATUS_PASSWORD_MUST_CHANGE, expired password, first logon.

Alternative via SMB: smbpasswd — see Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE

smbpasswd -U BABY/caroline.robinson -r baby.vl

---

kvno — get service ticket

Request a ticket for a service principal and show kvno (key version number).

kvno cifs/dc.corp.local
kvno HTTP/web.corp.local
kvno ldap/dc.corp.local

Useful to verify Kerberos auth to a specific SPN before Impacket -k.

---

ksu — Kerberos substitute user

Run a command as another user using your Kerberos credentials (if policy allows).

ksu targetuser@REALM.LOCAL -e /bin/bash
ksu -l targetuser@REALM.LOCAL

Less common on OSCP than kinit + Impacket.

---

ktutil — keytab management

Create or inspect keytab files (service keys, scripted auth).

ktutil
# ktutil> addent -password -p user@REALM -k 1 -e aes256-cts-hmac-sha1-96
# ktutil> wkt user.keytab
# ktutil> quit
 
kinit -k -t user.keytab user@REALM.LOCAL

---

kswitch — switch ticket cache

kswitch -c /tmp/krb5cc_1000
export KRB5CCNAME=/tmp/krb5cc_1000

---

Environment variables

Variable	Purpose
KRB5CCNAME	Ticket cache path — required for Impacket -k
KRB5_CONFIG	Alternate krb5.conf path
KRB5_KTNAME	Default keytab

export KRB5CCNAME=/tmp/krb5cc_1000
export KRB5_CONFIG=/tmp/krb5.conf

---

Typical OSCP flows

Normal domain user → Impacket

sudo timedatectl set-ntp false
sudo ntpdate -s DC_IP
kinit user@CORP.LOCAL
klist
export KRB5CCNAME=$(klist | grep 'Ticket cache' | awk '{print $3}')
impacket-wmiexec -k -no-pass CORP.LOCAL/user@TARGET -dc-ip DC_IP

Password must change first

sudo timedatectl set-ntp false
sudo ntpdate -s DC_IP
kpasswd user@CORP.LOCAL
# OR: smbpasswd -U DOMAIN/user -r domain.tld
kinit user@CORP.LOCAL    # use NEW password

Verify Kerberos before roasting

kinit user@CORP.LOCAL
klist
impacket-GetUserSPNs CORP.LOCAL/user -k -no-pass -dc-ip DC_IP -request

---

krb5-user vs other tools

Task	Tool
User enum / spray	Kerbrute
AS-REP / Kerberoast	Impacket GetNPUsers / GetUserSPNs
Password must change	kpasswd or smbpasswd → Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE
WinRM shell	evil-winrm
From Windows shell	Rubeus

---

Troubleshooting

Error	Fix
Cannot find KDC	Kerberos Setup - krb5.conf · /etc/hosts · realm case
Clock skew too great	Time Sync-Clock Skew — sudo timedatectl set-ntp false then sudo ntpdate -u DC_IP
Preauthentication failed	Wrong password or locked account
Client not found	Wrong principal spelling / realm

---

Quick cheat sheet

sudo apt install krb5-user
sudo timedatectl set-ntp false
sudo ntpdate -s DC_IP
 
kinit user@CORP.LOCAL
klist
kpasswd user@CORP.LOCAL
kdestroy
 
export KRB5CCNAME=$(klist | grep 'Ticket cache' | awk '{print $3}')

---

Related Tools

• Kerbrute
• Impacket
• Kerberos Scripts
• Rubeus
• Time Sync

Related Notes

• Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE
• Kerberos
• AD
• Kerberos Setup - krb5.conf
• Active Directory
• UseCases for ports
• Credential Graph