Enumerate Users using Kerberos

Technique Info

Prerequisites

• Knowledge of Active Directory Domain Name
• Knowledge of Domain Controller IP Address for the AD Domain
• Able to connect to port 88/TCP on the Domain Controller
• Able to gather a list of possible usernames (ex: ./got_users.txt)

Enumerate Users With VIA Guessing Usernames

With nmap

Command

sudo nmap -p 88 --script "krb5-enum-users" --script-args "krb5-enum-users.realm='sevenkingdoms.local',userdb=got_users.txt" 192.168.58.10 | grep "^|\ \ " | sed "s/^|\ \ *//g"

option/argument	explanation
-p 88	Kerberos Port
--script "krb5-enum-users"	Activates the kerberos user enum nmap NSE script
--script-args <args>	Specifies options for the nmap NSE script
"krb5-enum-users.realm='sevenkingdoms.local'...	specifies the AD Domain to enumerate users for
...userdb=got_users.txt"	Specifies a file containing list of possible usernames to try
192.168.58.10	The domain controller that corresponds to the specified AD Domain
`	grep ”^

Example

With kerbrute

Command

kerbrute userenum --dc 192.168.58.10 -d sevenkingdoms.local --safe --delay 5000 -o valid_user.txt ./got_users.txt

option/argument	explanation
userenum	activates kerbrute user enumeration module
--dc 192.168.58.10	specifies the IP address of the domain controller for the target domain
-d sevenkingdoms.local	specifies the active directory domain
--safe	Causes kerbrute to abort if any account lockouts are triggered
--delay 5000	Wait 5 seconds in between requests (stealth)
-o valid_users.txt	Write valid users to ./valid_users.txt
./got_users.txt	a file containing possible usernames

Example

“

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "active-directory") OR contains(tags, "enumeration") OR contains(tags, "kerberos")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

enumeration

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "enumeration")
SORT file.ctime DESC

kerberos

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "kerberos")
SORT file.ctime DESC