https://github.com/trustedsec/orpheus

Bypassing Kerberoast Detections with Modified KDC Options and Encryption Types
https://github.com/trustedsec/orpheus

Last synced: 4 days ago
JSON representation

Bypassing Kerberoast Detections with Modified KDC Options and Encryption Types

• Host: GitHub
• URL: https://github.com/trustedsec/orpheus
• Owner: trustedsec
• Created: 2022-10-18T15:48:38.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2023-02-19T04:16:25.000Z (almost 2 years ago)
• Last Synced: 2025-01-13T23:08:08.156Z (11 days ago)
• Language: Python
• Homepage:
• Size: 257 KB
• Stars: 376
• Watchers: 9
• Forks: 44
• Open Issues: 2
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# Orpheus

![Orpheus](orpheus.png?raw=true)

Orpheus is a wrapper for a modified version of Impacket's GetUserSPNs.py and kerberosv5.py which alters the KDC Options (Ticket Options) and the Encryption Type for Kerberoasting. 

Side Note: Orpheus is named after the Greek god that was able to get past Cerberus (the three headed dog) to get into Hades.

# Installation / Running

You will need to install the latest version of [Impacket](https://github.com/SecureAuthCorp/impacket). This was tested on the [0.10.0 release](https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_10_0). Then

```

git clone https://github.com/trustedsec/orpheus.git

cd orpheus

python3 orpheus.py

```

# Commands

Type help for a listing of commands. To change the KDC options, enter the number of the option and press enter.

```

Commands:

    0 to 31                       Toggles the specific KDC Option flag.

    hex                    Sets KDC Options from a hexadecimal value.

    cred                   Sets the GetUserSPNs.py credential parameter.

    dcip                   Sets the GetUserSPNs.py domain IP parameter.

    file                   Sets the GetUserSPNs.py filename parameter.

    enc                           Toggles the encryption type from 23 (RC4) to 18 (AES-256).

    command                       Show the GetUserSPNs.py command with specified options.

    run                           Runs GetUserSPNs.py with the selected options.

    clear                         Clears the screen and displays the options.

    exit                          Exits the script.

```

# Video

Check out the video on [YouTube](https://www.youtube.com/watch?v=SwbSq1dTz7Y)

# Blog Post

Check out the blog post on [TrustedSec](https://www.trustedsec.com/blog/the-art-of-bypassing-kerberoast-detections-with-orpheus/)