fist0urs / kerberom

Kerberom is a tool aimed to retrieve ARC4-HMAC'ed encrypted Tickets Granting Service (TGS) of accounts having a Service Principal Name (SPN) within an Active Directory

Kerberom

Kerberom is a tool aimed to retrieve ARC4-HMAC'ed encrypted Tickets Granting Service (TGS) of accounts having a Service Principal Name (SPN) within an Active Directory.

These tickets are stored in a format supported by John The Ripper bleeding-jumbo (https://github.com/magnumripper/JohnTheRipper) and hashcat (https://github.com/hashcat/hashcat).

Cracking these tickets gives you the associated accounts' password within the Active Directory.

You do not need any third-party tools that are OS dependents (like mimikatz or PowerShell) and do not need privileged rights to use kerberom

Author

• Jean-Christophe Delaunay, jean-christophe.delaunay (at) synacktiv.com

Greetings

• meskal
• The amazing impacket (https://github.com/CoreSecurity/impacket)
• Sylvain Monne, sylvain (dot) monne (at) solucom (dot) fr

kerberom.py

Prerequisites in explicit authentication:

• A domain account (eventually its SID if NTLM authentication is disabled upon Kerberos) and its credentials
• The address of the Domain Controler (can be a FQDN or IP address)
• The FQDN of the domain
• (Eventually a list of SPN with format "samaccountname$spn", field "samaccountname" can be "unknown")

Tickets can be retrieved using NTLM authentication but also Kerberos (this one needs you to provide the account SID as you will have to use it to make up your PAC) and providing password or hash (format "LM:NT") of the account used.

Prerequisites in implicit authentication (Windows only):

• Being in a user logged-on context
• The address of the Domain Controler (can be a FQDN or IP address)
• The FQDN of the domain
• (Eventually a list of SPN with format "samaccountname$spn", field "samaccountname" can be "unknown")

Install

kerberom is a standalone script/binary

Compilation (Windows only):

HOW-TO is provided in bin/BUILD.md

The binary is generated using PyInstaller and a new AES256 encryption key is generated each time the binary is compiled. This is only to break anti-viruses' signature engine based on kerberom source code.

Known-bug

Depending on your pyasn1 version, you may encounter parsing errors using explicit authentication.

Usage

usage: kerberom.py [-h] [--implicit IMPLICIT] [-u USERNAME]
                   [-d DOMAINCONTROLERADDR] [-o OUTPUTFILE]
                   [-iK INPUT_TGT_FILE] [-p PASSWORD | --hash HASH] [-v]
                   [--delta DELTA] [-k USER_SID | -i INPUTFILE_SPN]

Tool to retrieve all accounts having an SPN and their TGS in arc4-hmac
encrypted blob. Output is ready-to-crack for John The Ripper 'krb5tgs' and
hashcat 13100 formats, by jean-christophe.delaunay <at> synacktiv.com

optional arguments:
  -h, --help            show this help message and exit
  --implicit IMPLICIT   use Windows implicit authentication mechanism. Format
                        is (FQDN/IP)_DomainController[:port]@FQDN_Domain. eg:
                        192.168.13.13:[email protected]
  -u USERNAME, --username USERNAME
                        format must be userName@DomainFQDN. eg:
                        [email protected]
  -d DOMAINCONTROLERADDR, --domainControlerAddr DOMAINCONTROLERADDR
                        domain Controler FQDN. Can be an IP but ldap retrieval
                        through kerberos method will not work (-k)
  -o OUTPUTFILE, --outputfile OUTPUTFILE
                        outputfile where to store results and extracted
                        accounts having an SPN (to be used with '-i'
                        afterward)
  -iK INPUT_TGT_FILE, --input_TGT_File INPUT_TGT_FILE
                        user's provided file containing TGT. Parsing is
                        determined by extension (.ccache for Linux , Windows
                        is yet to be implemented)
  -p PASSWORD, --password PASSWORD
                        clear password submitted. Cannot be used with '--hash'
  --hash HASH           user's hash key. Format is "LM:NT". Cannot be used
                        with '-p'
  -v, --verbose         increase verbosity level
  --delta DELTA         set time delta in Kerberos tickets. Useful when DC is
                        not on the same timezone. Format is
                        "(+/-)hours:minutes:seconds", eg. --delta="+00:05:00"
                        or --delta="-02:00:00"
  -k USER_SID, --user_sid USER_SID
                        force ldap SPN retrieval through kerberos, sid is
                        mandatory. Cannot be used with '-i'
  -i INPUTFILE_SPN, --inputfile_spn INPUTFILE_SPN
                        retrieve TGS associated with SPN in user's provided
                        file. Format must be 'samaccountname$spn' on each
                        line, 'samaccountname' can be 'unknown'

kerberom's Issues

Add option to specify time-delta in Kerberos requests

Adding such an option would permit using Kerberom while target DC has not the same time. This would be usefull while using Kerberom through proxy (like proxychain)

Output real error message to STDERR, and keep log of working stuff on STDOUT

Example: In kerberom.py

        WRITE_STDERR(G + "\nAsking " + B + '\'' + DC_addr\
                           + '\'' + G + " for a TGT\n" + W)

        WRITE_STDERR('  [+] Building AS-REQ for %s...' % DC_addr)

Add Windows support

Add Windows support (py2exe could be used)

parsing error

Hey,

For some reason the tool pulls out the first hash fine, but then i get the error below and it dies, any ideas?:

running latest version on Kali 64 rolling ed.
thanks

[+] Building TGS-REQ for SPN 'mssqlsvc/xxxxx:1267' and account 'xxxxbackup'... Done!
[+] Sending TGS-REQ to xxxxxx.com... Done!
[+] Receiving TGS-REP from xxxxxx.com... Done!
[+] Parsing TGS-REP from xxxx..com..Traceback (most recent call last):
File "kerberom.py", line 557, in
DataSubmitted.TGS_attack()
File "kerberom.py", line 204, in TGS_attack
tgs_rep = parse_TGS_REP(sock, subkey, spn, samaccountname, self.DC_addr)[0]
File "kerberom.py", line 407, in parse_TGS_REP
tgs_rep, tgs_rep_enc = decrypt_tgs_rep(data, subkey)
File "/root/tools/kerberos/kerberom/modules/rom/krb5.py", line 443, in decrypt_tgs_rep
return _decrypt_rep(data, key, TgsRep(), EncTGSRepPart(), 9) # assume subkey
File "/root/tools/kerberos/kerberom/modules/rom/krb5.py", line 430, in _decrypt_rep
rep = decode(data, asn1Spec=spec)[0]
File "/usr/lib/python2.7/dist-packages/pyasn1/codec/ber/decoder.py", line 825, in call
stGetValueDecoder, self, substrateFun
File "/usr/lib/python2.7/dist-packages/pyasn1/codec/ber/decoder.py", line 50, in valueDecoder
value, _ = decodeFun(head, asn1Spec, tagSet, length)
File "/usr/lib/python2.7/dist-packages/pyasn1/codec/ber/decoder.py", line 831, in call
'%s not in asn1Spec: %s' % (tagSet, asn1Spec)
pyasn1.error.PyAsn1Error: [0:32:16]+[64:32:30] not in asn1Spec: TgsRep(componentType=NamedTypes(NamedType('pvno', Integer(tagSet=TagSet((), Tag(tagClass=0, tagFormat=0, tagId=2), Tag(tagClass=128, tagFormat=0, tagId=0)))), NamedType('msg-type', Integer(tagSet=TagSet((), Tag(tagClass=0, tag