cerbero_lib/lib.rs
1//! # cerbero-lib
2
3//! ```text
4//! ____ _ _ _ _
5//! / ___|___ _ __| |__ ___ _ __ ___ | (_) |__
6//! | | / _ \ '__| '_ \ / _ \ '__/ _ \ _____| | | '_ \
7//! | |__| __/ | | |_) | __/ | | (_) |_____| | | |_) |
8//! \____\___|_| |_.__/ \___|_| \___/ |_|_|_.__/
9//! ```
10//!
11//! Library to perform several tasks related with the Kerberos protocol in an Active Directory pentest.
12//!
13//! This repo was cloned from <https://gitlab.com/Zer1i0/cerbero> and has been converted into a library format.
14//! I intend to add more features/clean up the code further -- view the
15//! [TODO](https://github.com/NukingDragons/cerbero-lib/tree/main?tab=readme-ov-file#TODO) section
16//! in the associated [github](https://github.com/NukingDragons/cerbero-lib).
17//!
18//! ## Table of Contents
19//! 1. [**Installation**](#installation)
20//! 2. [**Functions**](#functions)
21//! - [**ask**](#ask)
22//! - [**asreproast**](#asreproast)
23//! - [**brute**](#brute)
24//! - [**convert**](#convert)
25//! - [**craft**](#craft)
26//! - [**hash**](#hash)
27//! - [**kerberoast**](#kerberoast)
28//! 3. [**TODO**](https://github.com/NukingDragons/cerbero-lib/tree/main?tab=readme-ov-file#TODO)
29//! 4. [**Credits**](#credits)
30//!
31//! ---
32//!
33//! ## Installation
34//!
35//! To use this library in your project you can add it via `cargo add`:
36//!
37//! ```sh
38//! cargo add cerbero-lib
39//! ```
40//!
41//! ## Functions
42//!
43//! ### Ask
44//! The [ask](fn.ask.html) function allows retrieval of Kerberos tickets (TGT/TGS) from the KDC
45//! (Domain Controller in Active Directory environment). Moreover, it also
46//! perform requests to obtain tickets by using the S4U2Self and S4U2Proxy
47//! Kerberos extensions.
48//!
49//! _(View the `ask` example [here](https://github.com/NukingDragons/cerbero-lib/tree/main/examples/ask/src/main.rs))_
50//!
51//! ### AsRepRoast
52//! The [asreproast](fn.asreproast.html) function can be used to discover users that do not require
53//! pre-authentication and retrieve a ticket to crack with hashcat or john.
54//!
55//! _(View the `asreproast` example [here](https://github.com/NukingDragons/cerbero-lib/tree/main/examples/asreproast/src/main.rs))_
56//!
57//! ### Brute
58//! The [brute](fn.brute.html) function performs TGT requests in order to discover user credentials
59//! based on the KDC response. This bruteforce technique allows you to discover:
60//! + Valid username/password pairs
61//! + Valid usernames
62//! + Expired passwords
63//! + Blocked or disabled users
64//!
65//! This attack should be performed carefully since can block user
66//! accounts in case of perform many incorrect authentication attemps
67//! for the same user.
68//!
69//! _(View the `brute` example [here](https://github.com/NukingDragons/cerbero-lib/tree/main/examples/brute/src/main.rs))_
70//!
71//! ### Convert
72//! The [convert](fn.convert.html) function will convert ticket files between krb (Windows)
73//! and ccache (Linux) formats.
74//!
75//! _(View the `convert` example [here](https://github.com/NukingDragons/cerbero-lib/tree/main/examples/convert/src/main.rs))_
76//!
77//! ### Craft
78//! The [craft](fn.craft.html) function allows for the crafting of golden and silver tickets.
79//!
80//! _(View the `craft` example [here](https://github.com/NukingDragons/cerbero-lib/tree/main/examples/craft/src/main.rs))_
81//!
82//! ### Hash
83//! The [hash](hash/index.html) module contains functions that calculate the Kerberos keys (password hashes) from the user password.
84//!
85//! _(View the `hash` example [here](https://github.com/NukingDragons/cerbero-lib/tree/main/examples/hash/src/main.rs))_
86//!
87//! ### Kerberoast
88//! The [kerberoast](fn.kerberoast.html) function can be used to retrieve a (potentially crackable) password hash
89//! for an account with an SPN set.
90//!
91//! To format encrypted part of tickets in order to be cracked by hashcat or john,
92//! you need to provide a file with the user services. Each line of the file
93//! must have one of the following formats:
94//! * `user`
95//! * `domain/user`
96//! * `user:spn`
97//! * `domain/user:spn`
98//!
99//! When a service [SPN](https://en.hackndo.com/service-principal-name-spn/)
100//! is not specified, then a
101//! [NT-ENTERPRISE principal](https://swarm.ptsecurity.com/kerberoasting-without-spns/)
102//! is used. This can also be useful to bruteforce users with services.
103//!
104//! _(View the `kerberoast` example [here](https://github.com/NukingDragons/cerbero-lib/tree/main/examples/kerberoast/src/main.rs))_
105//!
106//! ## Credits
107//! This work is based on great work of other people:
108//! - [Impacket](https://github.com/SecureAuthCorp/impacket) of Alberto Solino [@agsolino](https://github.com/agsolino)
109//! - [Rubeus](https://github.com/GhostPack/Rubeus) of Will [@harmj0y](https://twitter.com/harmj0y) and Elad Shamir [@elad_shamir](https://twitter.com/elad_shamir)
110//! - [Mimikatz](https://github.com/gentilkiwi/mimikatz) of [@gentilkiwi](https://twitter.com/gentilkiwi)
111//! - [Cerbero](https://gitlab.com/Zer1i0/cerbero) of Eloy [@zer1i0](zer1t0ps@protonmail.com)
112
113// TODO: Fix the issues causing these warnings instead of this lazy fix
114#![allow(deprecated)]
115#![allow(clippy::too_many_arguments)]
116
117mod commands;
118mod communication;
119mod core;
120mod error;
121
122/// Utilities for converting various things in this crate into strings
123pub use crate::core::stringifier;
124
125/// The file formats for tickets (KRB/CCache)
126pub use crate::core::CredFormat;
127
128pub use crate::{
129 commands::{ask, asreproast, brute, convert, craft, hash, kerberoast},
130 communication::{KdcComm, Kdcs, KrbChannel, TransportProtocol},
131 core::{
132 BruteResult, BufVault, CrackFormat, EmptyVault, EncryptionType, FileVault, KrbUser, TicketCred, TicketCreds,
133 Vault,
134 },
135 error::{Error, Result},
136};
137
138pub use kerberos_asn1::Ticket;
139pub use kerberos_crypto::Key;
140
141#[cfg(target_os = "windows")]
142pub use crate::core::WindowsVault;