The Manticore Project
GitHub Discord Get Started
Generated from Manticore v1.1.6 • 388 packages. View on pkg.go.dev

attacks

import "github.com/TheManticoreProject/Manticore/network/kerberos/v5/attacks"

Package attacks provides the offensive-tooling surface built on the native Kerberos primitives: hashcat-compatible hash formatting for AS-REP roasting and Kerberoasting. The network operations live on the client (kerberos.ASREPRoast, KerberosClient.Kerberoast); this package turns their encrypted output into crackable hash strings.

Index

func FormatASREPHash

func FormatASREPHash(username, realm string, etype int, cipher []byte) (string, error)

FormatASREPHash formats an AS-REP encrypted part as a hashcat AS-REP-roast hash. Only RC4 (etype 23) is supported: it yields the mode-18200 form “$krb5asrep$23$user@realm:<checksum>$<edata>”.

hashcat has NO AS-REP mode for AES enctypes — mode 18200 is RC4/etype-23 only, and the AES Kerberos modes cover TGS-REP (19600/19700), Pre-Auth (19800/19900) and the KDC database (28800/28900), not AS-REP. Emitting an “$krb5asrep$17/18$” string is therefore uncrackable (hashcat rejects it with a token-length error), so this function returns an error for any non-RC4 etype. Use FormatASREPHashJohn (John the Ripper), which does support AES AS-REP roasting.

func FormatASREPHashJohn

func FormatASREPHashJohn(username, realm string, etype int, cipher []byte) (string, error)

FormatASREPHashJohn formats an AS-REP encrypted part as a John the Ripper krb5asrep hash.

RC4 (etype 23) yields “$krb5asrep$23$<checksum>$<edata>” (no principal, unlike hashcat mode 18200). AES enctypes (17/18) yield “$krb5asrep$<etype>$<UPPER-REALM><username>$<edata>$<checksum>”.

func FormatTGSHash

func FormatTGSHash(account, realm, spn string, etype int, cipher []byte) (string, error)

FormatTGSHash formats a service ticket’s encrypted part as a hashcat Kerberoast hash. RC4 (etype 23) yields the mode-13100 form “$krb5tgs$23$*account$realm$spn*$<checksum>$<edata>”; AES enctypes yield the mode-19600/19700 form “$krb5tgs$<etype>$account$realm$<checksum>$<edata>” (which carries no SPN, matching hashcat’s format).

func FormatTGSHashJohn

func FormatTGSHashJohn(account, realm, spn string, etype int, cipher []byte) (string, error)

FormatTGSHashJohn formats a service ticket’s encrypted part as a John the Ripper krb5tgs hash.

RC4 (etype 23) yields “$krb5tgs$23$*<account>$<realm>$<spn>*$<checksum>$<edata>” (identical to hashcat mode 13100). AES enctypes (17/18) yield “$krb5tgs$<etype>$<UPPER-REALM><account>$<edata>$<checksum>” (the checksum is appended after the encrypted data and the account is folded into the salt).