cerbero-lib 0.0.20

Kerberos protocol attacker library
Documentation
cerbero-lib-0.0.20 has been yanked.

Cerbero

Crates.io Language Rust

Library to perform several tasks related with Kerberos protocol in an Active Directory pentest.

This repo was cloned from https://gitlab.com/Zer1i0/cerbero and has been converted into a library format. I intend to add more features/clean up the code further, see the TODO section.

Installation

To use this library in your project you can add it via cargo add:

cargo add cerbero-lib

Functions

Ask

The ask command allows to retrieve Kerberos tickets (TGT/TGS) from the KDC (Domain Controller in Active Directory environment). Moreover, it also perform requests to obtain tickets by using the S4U2Self and S4U2Proxy Kerberos extensions.

See the example

AsRepRoast

asreproast can be used to discover users that do not require pre-authentication and retrieve a ticket to crack with hashcat or john.

See the example

Brute

brute performs TGTs requests in order to discover user credentials based on the KDC response. This bruteforce technique allows you to discover:

  • Valid username/password pairs
  • Valid usernames
  • Expired passwords
  • Blocked or disabled users

This attack should be performed carefully since can block user accounts in case of perform many incorrect authentication attemps for the same user.

See the example

Convert

convert ticket files between krb (Windows) and ccache (Linux) formats.

See the example

Craft

To craft golden and silver tickets.

See the example

Hash

Calculate the Kerberos keys (password hashes) from the user password.

See the example

Kerberoast

To format encrypted part of tickets in order to be cracked by hashcat or john.

You need to provide a file with the user services. Each line of the file must have one of the following formats:

  • user
  • domain/user
  • user:spn
  • domain/user:spn

When a service SPN is not specified, then a NT-ENTERPRISE principal is used. This can also be useful to bruteforce users with services.

See the example

TODO

  • Clean up the code, there's a ton of verbose returns that don't need to be there and some double dereferences
  • Make the arguments to the commands more concise
  • Remove some of the allows inside of lib.rs
  • Improve documentation significantly, including README and the examples directory

Credits

This work is based on great work of other people: