← Back to Academy

Academy Node

Kerberos Enumeration

Kerberos enumeration checks domain validity, users, ASREP roastability, SPNs, and time-sensitive auth behavior.

Beginner100 XPEnumeration

Why it matters

Kerberos gives fast wins through ASREP roast, Kerberoast, and ticket-based movement.

How to identify it

  • Port 88 open
  • Domain name known
  • Usernames available

BloodHound indicators

  • ASREP roastable
  • Kerberoastable

NetExec commands

nxc ldap 192.168.184.141 -d xutslabs.local -u users.txt -p '' --asreproast asrep.txt

Impacket commands

impacket-GetNPUsers xutslabs.local/ -usersfile users.txt -dc-ip 192.168.184.141 -no-pass
impacket-GetUserSPNs xutslabs.local/ba_low:'Password123' -dc-ip 192.168.184.141 -request

Linux commands

sudo ntpdate -u 192.168.184.141

Expected output

  • $krb5asrep$
  • $krb5tgs$
  • KRB_AP_ERR_SKEW if time is wrong

Success looks like

  • Hash obtained
  • Ticket obtained
  • Creds validated

Failure looks like

  • Clock skew
  • No roastable users
  • KDC_ERR_C_PRINCIPAL_UNKNOWN

Troubleshooting

  • Sync time to DC
  • Use FQDN
  • Use -dc-ip

Common mistakes

  • Not syncing time
  • Wrong realm casing
  • No /etc/hosts entry

Alternative attacks

  • LDAP enum
  • SMB share hunting

What to try next

  • Crack hashes
  • Validate creds
  • Run BloodHound

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.