kerberos

import "github.com/TheManticoreProject/Manticore/network/kerberos/v5"

Package kerberos provides Kerberos authentication primitives for Active Directory. It includes a native client (KerberosClient), ASREPRoast, and a gokrb5-backed helper (KerberosInit) used for LDAP GSSAPI binds.

Package kerberos provides a native Kerberos client implementation for Active Directory authentication, without external dependencies. It supports RC4-HMAC and AES-CTS-HMAC-SHA1-96 encryption types.

Index

• func KerberosInit(fqdnLDAPHost, fqndRealm string) (string, *config.Config)
• type ASREPRoastResult
  • func ASREPRoast(username, realm, kdcHost string) (*ASREPRoastResult, error)
• type KerberosClient
  • func NewClient(username, realm, kdcHost string) *KerberosClient
  • func (c *KerberosClient) Destroy()
  • func (c *KerberosClient) GetTGS(spn string, includePAC bool) (messages.Ticket, []byte, []byte, error)
  • func (c *KerberosClient) GetTGT() error
  • func (c *KerberosClient) KDCHost() string
  • func (c *KerberosClient) Realm() string
  • func (c *KerberosClient) Username() string
  • func (c *KerberosClient) WithCCache(_ string) error
  • func (c *KerberosClient) WithPassword(password string) *KerberosClient

func KerberosInit

func KerberosInit(fqdnLDAPHost, fqndRealm string) (string, *config.Config)

KerberosInit initialises a gokrb5 configuration and returns the LDAP service principal name for the given host and realm.

It is used by the LDAP session layer to perform GSSAPI Kerberos binds via the gokrb5 library. The native KerberosClient does not depend on this function.

Parameters:

• fqdnLDAPHost: Fully qualified domain name (or IP) of the KDC / LDAP server.
• fqndRealm: Kerberos realm (will be uppercased automatically).

Returns the service principal name (“ldap/<fqdnLDAPHost>”) and a ready-to-use *config.Config.

type ASREPRoastResult

ASREPRoastResult contains the raw fields extracted from an AS-REP response for an account that does not require Kerberos pre-authentication (UF_DONT_REQUIRE_PREAUTH). The caller is responsible for formatting CipherText into a crackable hash (e.g. hashcat $krb5asrep$<etype>$<username>@<realm>:<first16>$<rest>).

type ASREPRoastResult struct {
    // Username is the account that was targeted.
    Username string
    // Realm is the Kerberos realm (uppercased).
    Realm string
    // EncryptionType is the etype of the encrypted part (23=RC4, 17=AES128, 18=AES256).
    EncryptionType int
    // CipherText is the raw encrypted part of the AS-REP, crackable offline.
    CipherText []byte
}

func ASREPRoast

func ASREPRoast(username, realm, kdcHost string) (*ASREPRoastResult, error)

ASREPRoast sends an AS-REQ without pre-authentication data for the given username and returns the encrypted part of the AS-REP response for offline cracking.

If the account requires pre-authentication the KDC responds with KDC_ERR_PREAUTH_REQUIRED (25) and this function returns an error. If the account does not exist the KDC responds with KDC_ERR_C_PRINCIPAL_UNKNOWN (6).

type KerberosClient

KerberosClient manages Kerberos authentication against an Active Directory KDC.

It provides protocol-level primitives: TGT acquisition with PA-ENC-TIMESTAMP pre-authentication, TGS requests, and ASREPRoast. All cryptographic operations use the native Manticore implementations (no external Kerberos library).

Typical usage:

c := kerberos.NewClient("john", "CORP.LOCAL", "10.0.0.1")
c.WithPassword("secret")
if err := c.GetTGT(); err != nil { ... }
ticket, ticketRaw, sessionKey, err := c.GetTGS("cifs/dc01.corp.local", true)

type KerberosClient struct {
    // contains filtered or unexported fields
}

func NewClient

func NewClient(username, realm, kdcHost string) *KerberosClient

NewClient creates a new KerberosClient for the given username, realm and KDC host. The realm is uppercased automatically (required by the Kerberos specification). Call WithPassword before calling GetTGT.

func (*KerberosClient) Destroy

func (c *KerberosClient) Destroy()

Destroy zeroes out key material held by the client.

func (*KerberosClient) GetTGS

func (c *KerberosClient) GetTGS(spn string, includePAC bool) (messages.Ticket, []byte, []byte, error)

GetTGS requests a service ticket for the given Service Principal Name. GetTGT must have been called successfully beforehand.

The SPN format is “service/host” (e.g. “cifs/dc01.corp.local”) or “service/host@REALM”.

includePAC controls whether the KDC should include the PAC in the service ticket. Pass false for kerberoasting (produces shorter, hashcat-crackable ciphers).

Returns the parsed service Ticket, the raw APPLICATION[1] ticket bytes as received from the KDC (suitable for verbatim re-emission in a downstream AP-REQ via messages.APReq{TicketRaw: …}.Marshal), and the associated session key bytes.

func (*KerberosClient) GetTGT

func (c *KerberosClient) GetTGT() error

GetTGT requests a Ticket Granting Ticket from the KDC using the password configured via WithPassword.

Windows KDCs silently drop AS-REQs without PA-ENC-TIMESTAMP, so we skip the probe and send PA-ENC-TIMESTAMP immediately with the default AD salt (realm+username). If the KDC returns PREAUTH_REQUIRED with different etype/salt info, we retry once with the corrected values.

func (*KerberosClient) KDCHost

func (c *KerberosClient) KDCHost() string

KDCHost returns the KDC host configured for this client.

func (*KerberosClient) Realm

func (c *KerberosClient) Realm() string

Realm returns the realm (uppercased) configured for this client.

func (*KerberosClient) Username

func (c *KerberosClient) Username() string

Username returns the username configured for this client.

func (*KerberosClient) WithCCache

func (c *KerberosClient) WithCCache(_ string) error

WithCCache is not yet supported in the native implementation. Use the gokrb5-backed KerberosInit helper for ccache-based LDAP binds.

func (*KerberosClient) WithPassword

func (c *KerberosClient) WithPassword(password string) *KerberosClient

WithPassword stores the password for use in GetTGT. Returns the client to allow fluent chaining.