Kerb

Commands for working with Kerberos authentication

Synopsis

Kerb <subcommand>

Subcommands

Command Description
asreq Requests a TGT from the KDC.
changepw Changes an account password
forge Forges a ticket
getasinfo Gets server time and encryption types (with salts) for a user account.
keytab Display and edit keytab files
renew Renews a ticket
s2k Generates a protocol key from a string, such as a password
select Selects and displays tickets from a file.
setpw Sets the password of (another) account
tgsreq Requests a ticket from the KDC.

For help on a subcommand, use Kerb <subcommand> -h

Kerb asreq

Requests a TGT from the KDC.

Synopsis

Kerb asreq [options] <UserName> <Kdc>

Parameters

Name Aliases Value Description
<UserName>   <UserPrincipalName> Name of user (no domain)
<Kdc>   <EndPoint> Host name or address of KDC

Options

Name Aliases Value Description
-ArmorTicket   <String> Name of file containing armor ticket
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-S, -Socks5   <host-or-ip:port> End point of SOCKS 5 server to use
-Target   <SecurityPrincipalName[]> SPNs to request ticket(s) for
-TicketComment   <String> Comment to associate with ticket

Authentication (Kerberos)

Name Aliases Value Description
-AesKey   <HexString> AES 128 key
-DesKey   <HexString> DES key
-EncTypes   <EType[]> Encryption types to request in response
      Possible values:
      DesCbcMd5
      DesCbcCrc
      Rc4Hmac
      Rc4HmacExp
      Aes128CtsHmacSha1_96
      Aes256CtsHmacSha1_96
      DsaWithSha1
      Md5WithRsa
      Sha1WithRsa
      Rc2Cbc
      Rsa
      RsaesOaep
      DesEde3Cbc
-EndTime   <DateTime> End time
-F, -Forwardable   <SwitchParam> Requests a forwardable ticket
-Keytab   <String> Name of keytab file
-N, -NtlmHash   <HexString> NTLM hash (hex-encoded, no colons)
-Password   <String> Password
-Postdate   <DateTime> Requests a postdated ticket with the specified start date
-Proxiable   <SwitchParam> Requests a forwardable ticket
-Realm   <String> Name of realm (domain)
-Renewable   <SwitchParam> Requests a renewable ticket
-RenewableOk   <SwitchParam> Accepts a renewable ticket if the end time is over the limit
-RenewTill   <DateTime> Requests a ticket renewable until the specified time (implies -Renewable)
-TicketCache   <String> Name of ticket cache file
-UserCert   <String> Name of file containing user’s certificate (for PKINIT)
-UserKey   <String> Name of file containing user’s key (for PKINIT)
-UserKeyPassword   <String> Password to decrypt file containing user’s key (for PKINIT)
-W, -Workstation   <String> Name of client workstation

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint

Output

Name Aliases Value Description
-Append   <SwitchParam> Appends to the output file, if it exists
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-OutputFileName   <String> Name of file to write ticket to
-Overwrite   <SwitchParam> Overwrites the output file, if it exists
-Verbose -V <SwitchParam> Prints verbose messages

Details

This command sends an AS-REQ to the KDC to request a ticket-granting ticket.

The command line must include either a password or a hex-encoded key that is used both for preauthentication as well as to decrypt the response. When specifying the NTLM hash, specify just the NTLM portion with no colon.

The provided credential determines the encryption type of the response. If you provide a password then all encryption types supported by Kerb asreq are presented. To override this, use -EncTypes to specify a list of encryption types to accept. Note that this only effects the encryption used in the response and not the preauthorization data.

Dates/times are interpreted as local time unless otherwise specified. If only a time is supplied, the assumed date is today.

Note that the ticket flags and time parameters affect the request sent to the KDC. However, the KDC is free to ignore them; specifying an option doesn’t guarantee that the ticket will have the requested option.

If you don’t specify any options for the ticket, Kerb asreq uses default values, requesting a ticket that expires 10 hours from now with the options Canonicalize, RenewableOk, Renewable, and Forwardable. If any options are specified, then no default values are applied and only the options specified are used.

Examples

Example 1 - Requesting a TGT with a user name / password

Kerb asreq -UserName milchick -Realm LUMON -Password Br3@kr00m! -Kdc LUMON-DC1 -v -OutputFileName milchick-tgt.kirbi -Overwrite

Example 2 - Requesting a TGT with a UPN / password

Kerb asreq -UserName milchick@LUMON.IND -Password Br3@kr00m! -Kdc LUMON-DC1 -v -OutputFileName milchick-tgt.kirbi -Overwrite

Example 3 - Requesting a TGT with PKINIT

Kerb asreq -UserName milchick@LUMON.IND -UserCert milchick.pfx -UserKeyPassword password -Kdc LUMON-DC1 -v -OutputFileName milchick-tgt.kirbi -Overwrite

Example 4 - Requesting a TGT with a password request Rc4Hmac

Kerb asreq -UserName milchick -Realm LUMON -Password Br3@kr00m! -EncTypes Rc4Hmac -Kdc 10.66.0.11 -v -OutputFileName milchick-tgt.kirbi -Overwrite

Example 5 - Requesting a TGT with a password request AES 128 or AES 256

Kerb asreq -UserName milchick -Realm LUMON -Password Br3@kr00m! -EncTypes Aes128CtsHmacSha1_96, Aes256CtsHmacSha1_96 -Kdc 10.66.0.11 -v -OutputFileName milchick-tgt.kirbi -Overwrite

Example 6 - Requesting a TGT with an NTLM Hash

Kerb asreq -UserName milchick -NtlmHash B406A01772D0AD225D7B1C67DD81496F -Kdc 10.66.0.11 -Realm LUMON -v -OutputFileName milchick-tgt.kirbi -Overwrite

Example 7 - Requesting a TGT with an AES 128 key

Kerb asreq -UserName milchick -AesKey c5673764957bc2839e367ba7b82f32e1 -Kdc 10.66.0.11 -Realm LUMON -v -OutputFileName milchick-tgt.kirbi -Overwrite

Example 8 - Requesting a TGT with an AES 256 key

Kerb asreq -UserName milchick -AesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 -Kdc 10.66.0.11 -Realm LUMON -v -OutputFileName milchick-tgt.kirbi -Overwrite

Kerb changepw

Changes an account password

Synopsis

Kerb changepw [options] <UserName> <Kdc> <NewPassword>

Parameters

Name Aliases Value Description
<UserName>   <UserPrincipalName> Name of user (no domain)
<Kdc>   <EndPoint> Host name or address of KDC
<NewPassword>   <String> New password to set

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-S, -Socks5   <host-or-ip:port> End point of SOCKS 5 server to use

Authentication (Kerberos)

Name Aliases Value Description
-A, -AesKey   <HexString> AES 128 key
-DesKey   <HexString> DES key
-Keytab   <String> Name of keytab file
-NtlmHash   <HexString> NTLM hash (hex-encoded, no colons)
-P, -Password   <String> Password
-R, -Realm   <String> Name of realm (domain)
-UserCert   <String> Name of file containing user’s certificate (for PKINIT)
-UserKey   <String> Name of file containing user’s key (for PKINIT)
-UserKeyPassword   <String> Password to decrypt file containing user’s key (for PKINIT)
-W, -Workstation   <String> Name of client workstation

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint

Output

Name Aliases Value Description
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-Verbose -V <SwitchParam> Prints verbose messages

Details

Kerb changepw uses the Kerberos Change Password protocol and can only be used to change the password of the authenticating user. To set the password of another user, use the setpw command.

This protocol requires an initial ticket. That is, it requires a ticket from an ASREQ/ASREP exchange and not from a TGSREQ/TGSREP exchange. Therefore, this command requires credentials and does not accept a ticket as a parameter. The setpw command does not have this restriction and accepts a ticket as a parameter.

Examples

Example 1 - milchick changing his own password

Kerb changepw milchick@LUMON 10.66.0.11 -Password EradicateFolly! Br3@kr00m!

Kerb forge

Forges a ticket

Synopsis

Kerb forge [options] -TicketEType <EType> -TicketKey <HexString> -UserSid <SecurityIdentifier> -UserName <UserPrincipalName> <Target>

Parameters

Name Aliases Value Description
<Target>   <SecurityPrincipalName[]> Target SPN

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-DomainRids   <UInt32[]> Group RIDs, relative to the user domain
-E, -ExtraSids   <SecurityIdentifier[]> Extra group SIDs
-F, -FullName   <String> User’s full name
-HomeDirectory   <String> UNC path of home directory
-HomeDrive   <String> Home Drive (e.g. H:)
-LogonScript   <String> UNC path of logon script
-LogonServer   <String> Name of logon server
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-PrimaryGroupId   <UInt32> Primary group ID
-ProfilePath   <String> UNC path of user profile
-Realm   <String> Ticket realm
-ResourceDomainSid   <SecurityIdentifier> Domain of SID containing resource
-ResourceGroupRids   <UInt32[]> Group RIDs, relative to the resource domain
-S, -ServiceRealm   <String> Service realm
-TicketEType   <EType> Ticket encryption type
      Possible values:
      DesCbcMd5
      DesCbcCrc
      Rc4Hmac
      Rc4HmacExp
      Aes128CtsHmacSha1_96
      Aes256CtsHmacSha1_96
      DsaWithSha1
      Md5WithRsa
      Sha1WithRsa
      Rc2Cbc
      Rsa
      RsaesOaep
      DesEde3Cbc
-TicketKey   <HexString> Key to encrypt ticket with
-UserDomain   <String> Logon domain (NetBIOS) of the user
-UserName   <UserPrincipalName> User name
-UserRealm   <String> Logon domain (FQDN) of the user
-UserSid   <SecurityIdentifier> User SID

Authentication (Kerberos)

Name Aliases Value Description
-TicketCache   <String> Name of ticket cache file
-W, -Workstation   <String> Name of client workstation

Output

Name Aliases Value Description
-A, -Append   <SwitchParam> Appends to the output file, if it exists
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-OutputFileName   <String> Name of file to write ticket to
-Overwrite   <SwitchParam> Overwrites the output file, if it exists
-Verbose -V <SwitchParam> Prints verbose messages

Details

The forged ticket includes a PAC signed with

Kerb getasinfo

Gets server time and encryption types (with salts) for a user account.

Synopsis

Kerb getasinfo [options] <UserName> <Kdc>

Parameters

Name Aliases Value Description
<UserName>   <UserPrincipalName> Name of user (no domain)
<Kdc>   <String> Host name or address of KDC

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-E, -EncTypes   <EType[]> ETypes to request
      Possible values:
      DesCbcMd5
      DesCbcCrc
      Rc4Hmac
      Rc4HmacExp
      Aes128CtsHmacSha1_96
      Aes256CtsHmacSha1_96
      DsaWithSha1
      Md5WithRsa
      Sha1WithRsa
      Rc2Cbc
      Rsa
      RsaesOaep
      DesEde3Cbc
-OutputFields   <String[]> Fields to display in output
      Possible values:
      EType
      SaltText
      SaltHex
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-S, -Socks5   <host-or-ip:port> End point of SOCKS 5 server to use

Authentication (Kerberos)

Name Aliases Value Description
-R, -Realm   <String> Name of realm (domain)

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint

Output

Name Aliases Value Description
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-Verbose -V <SwitchParam> Prints verbose messages

Details

This command sends an AS-REQ to the KDC for a user and checks the response. Typically, the KDC response with an error indicating that preauthentication is required along with its time and valid encryption wypes for the specified account. This command analyzes that error response and prints the information.

If the account does not exist or the realm name is wrong, the KDC returns an error indicating this and does not provide preauthentication info.

If the user exists but does not require preauthentication, the KDC will instead reply with a TGT without providing encryption types. In that case, use the requesttgt command to analyze the ticket.

Examples

Example 1 - Get AS info for milchick

Kerb getasinfo milchick@LUMON 10.66.0.11

Kerb keytab

Display and edit keytab files

Synopsis

Kerb keytab <subcommand>

Subcommands

Command Description
list Lists the entries in a keytab file

For help on a subcommand, use Kerb keytab <subcommand> -h

Kerb renew

Renews a ticket

Synopsis

Kerb renew [options] <Kdc> [ <TargetSpn> ]

Parameters

Name Aliases Value Description
<Kdc>   <EndPoint> Host name or address of KDC
-TargetSpn   <SecurityPrincipalName[]> SPNs to renew tickets for

Options

Name Aliases Value Description
-ArmorTicket   <String> Name of file containing armor ticket
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-S, -Socks5   <host-or-ip:port> End point of SOCKS 5 server to use
-TicketComment   <String> Comment to associate with ticket

Authentication (Kerberos)

Name Aliases Value Description
-E, -EndTime   <DateTime> End time
-F, -Forwardable   <SwitchParam> Requests a forwardable ticket
-Postdate   <DateTime> Requests a postdated ticket with the specified start date
-Proxiable   <SwitchParam> Requests a forwardable ticket
-Renewable   <SwitchParam> Requests a renewable ticket
-RenewableOk   <SwitchParam> Accepts a renewable ticket if the end time is over the limit
-RenewTill   <DateTime> Requests a ticket renewable until the specified time (implies -Renewable)
-TargetSpn   <SecurityPrincipalName[]> SPNs to renew tickets for
-Ticket   <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-TicketCache   <String> Name of ticket cache file
-W, -Workstation   <String> Name of client workstation

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint

Output

Name Aliases Value Description
-Append   <SwitchParam> Appends to the output file, if it exists
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-OutputFileName   <String> Name of file to write ticket to
-Overwrite   <SwitchParam> Overwrites the output file, if it exists
-Verbose -V <SwitchParam> Prints verbose messages

Details

This command sends a request to the TGS to renew the source ticket. You may provide the source ticket to renew either with -Ticket or -TicketCache. For -TicketCache, -TargetSpn is required; for -Ticket, -TargetSpn is optional. If you specify both -Ticket and -TicketCache, Kerb renew only loads source tickets from -Ticket and only uses -TicketCache for output.

If you specify -TargetSpn with one or more SPNs, Kerb renew only renews tickets matching one of the specified SPNs.

Examples

Example 1 - Renewing all tickets in a file

Kerb renew -Ticket milchick-lumon-fs1.kirbi 10.66.0.11 -OutputFileName milchick-lumon-fs1.kirbi -Overwrite

Example 2 - Renewing tickets from cache

Kerb renew -TicketCache milchick.ccache 10.66.0.11 -TargetSpn host/lumon-fs1, cifs/lumon-fs1

Kerb s2k

Generates a protocol key from a string, such as a password

Synopsis

Kerb s2k [options] <Password> [ <Salt> ] [ <EncType> ]

Parameters

Name Aliases Value Description
<Password>   <String> String, such as the password
-S, -Salt   <String> Salt as a string
-E, -EncType   <EType[]> Encryption types to generate for
      Possible values:
      DesCbcMd5
      DesCbcCrc
      Rc4Hmac
      Rc4HmacExp
      Aes128CtsHmacSha1_96
      Aes256CtsHmacSha1_96
      DsaWithSha1
      Md5WithRsa
      Sha1WithRsa
      Rc2Cbc
      Rsa
      RsaesOaep
      DesEde3Cbc

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-ContinueOnError   <SwitchParam> Continue even if errors occur
-E, -EncType   <EType[]> Encryption types to generate for
      Possible values:
      DesCbcMd5
      DesCbcCrc
      Rc4Hmac
      Rc4HmacExp
      Aes128CtsHmacSha1_96
      Aes256CtsHmacSha1_96
      DsaWithSha1
      Md5WithRsa
      Sha1WithRsa
      Rc2Cbc
      Rsa
      RsaesOaep
      DesEde3Cbc
-OutputFields   <String[]> Fields to display in output
      Possible values:
      EType
      KeyText
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-S, -Salt   <String> Salt as a string

Output

Name Aliases Value Description
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-H, -HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-Verbose -V <SwitchParam> Prints verbose messages

Details

When authenticating with a password, Kerberos internally generates a protocol key from the password and the accompanying salt using the String-to-key function defined for each encryption profile. For Windows domains, the salt for a user account is usually the FQDN of the domain in uppercase followed by the account name. Specifically, the salt is composed of the domain and SAM account name at the time of the last password is changed. Therefore, if an account has been renamed, the salt retains the old account name until the user changes the password again.

NOTE: Be sure to read the above regarding salts. Using the wrong salt has the same effect as using the wrong password and may result in account lockout.

You may use Kerb getasinfo to get the salt for an account.

For more details, see [MS-KILE] § 3.1.1.2

The domain name used for the salt must be the FQDN of the domain, not the shorter NetBIOS name.

Examples

Example 1 - Generate keys for milchick in domain LUMON.IND

Kerb s2k Br3@kr00m! LUMON.INDseth

Example 2 - Generate AES keys for milchick in domain LUMON.IND

Kerb s2k Br3@kr00m! LUMON.INDseth -EncType Aes128CtsHmacSha1_96, Aes256CtsHmacSha1_96

Example 3 - Generate keys for computer ALLENTOWN$ in domain LUMON.IND

Kerb s2k password LUMON.INDhostallentown.lumon.ind

Kerb select

Selects and displays tickets from a file.

Synopsis

Kerb select [options] [ <From> ]

Parameters

Name Aliases Value Description
<From>   <String[]> File names or patterns

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-OutputFields   <String[]> Fields to display in output
      Possible values:
      SourceFileName
      SeqNbr
      Comment
      ClientName
      ClientRealm
      TicketRealm
      TargetSpn
      ServiceClass
      ServiceInstance
      ServiceRealm
      KdcOptions
      EndTime
      StartTime
      RenewTill
      AsrepKeyText
      TicketKeyText
      SupportedEncryptionTypes
      SessionEType
      SessionKeyText
      TicketEType
      TgsrepHashcatMethod
      TicketHash
      IsCurrent
      CachedAuthData
      SecurityGroups
      NtlmHashText
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True

Output

Name Aliases Value Description
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-H, -HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-Into   <String> Target file name
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-Overwrite   <SwitchParam> Overwrites target file if it exists
-P, -PrintAuthData   <SwitchParam> Prints ticket authorization data (if decrypted)
-Verbose -V <SwitchParam> Prints verbose messages

Ticket Decryption

Name Aliases Value Description
-ServicePassword   <String[]> Password for service account
-ServiceSalt   <String[]> Salt for service account
-TicketKey   <HexString[]> Key to decrypt the ticket

Ticket Filter

Name Aliases Value Description
-Current   <SwitchParam> Only select tickets currently valid
-InvertMatch   <SwitchParam> Invert match; select whatever doesn’t match
-MatchingClientName   <String[]> Regex of client name to match
-MatchingSessionEType   <EType[]> Filter for session key encryption type
      Possible values:
      DesCbcMd5
      DesCbcCrc
      Rc4Hmac
      Rc4HmacExp
      Aes128CtsHmacSha1_96
      Aes256CtsHmacSha1_96
      DsaWithSha1
      Md5WithRsa
      Sha1WithRsa
      Rc2Cbc
      Rsa
      RsaesOaep
      DesEde3Cbc
-MatchingSpn   <String[]> Regex of SPN to match
-MatchingTicketEType   <EType[]> Filter for ticket encryption type
      Possible values:
      DesCbcMd5
      DesCbcCrc
      Rc4Hmac
      Rc4HmacExp
      Aes128CtsHmacSha1_96
      Aes256CtsHmacSha1_96
      DsaWithSha1
      Md5WithRsa
      Sha1WithRsa
      Rc2Cbc
      Rsa
      RsaesOaep
      DesEde3Cbc
-SeqNbr   <NumberOrRange[]> Seq. nbr. or range

Ticket Source

Name Aliases Value Description
-TicketCache   <String> Name of ticket cache file

Details

This command reads tickets from one or more files (.kirbi or .ccache), optionally filters them, and optionally writes the results to another file (either .kirbi or .ccache). It can be used to inspect files, convert files, combine files, or remove tickets from files.

The command accepts both -TicketCache and -From to specify one or more files to read tickets from. If -From is specified, -TicketCache is ignored. This is to facilitate the use of $KRB5CCNAME. If this environment variable is set, you don’t need to specify -From. If you specify -From, this expresses your desire to ignore the ticket cache.

Specify the source files using -From. You may specify multiple files and multiple wildcard patterns. Kerb select reads all files from the tickets and applies any filters specified before printing the tickets to the screen. If you specify -Into, the results are written to the file you specify. Use -Overwrite to overwrite the outptu file if it already exists.

Examples

Example 1 - Print tickets from all mlichick*.ccache files

Kerb select -From milchick*.ccache

Example 2 - Combine tickets from all mlichick*.kirbi files

Kerb select -From milchick*.ccache -Into all-milchick.ccache

Example 3 - Print only current tickets from all mlichick*.kirbi files

Kerb select -From milchick*.kirbi -Current

Example 4 - Print only TGTs

Kerb select -From milchick*.kirbi -MatchingSpn krbtgt/.*

Example 5 - Print only tickets for CIFS

Kerb select -From milchick*.kirbi -MatchingSpn cifs/.*

Example 6 - Print only tickets targeting LUMON-FS1

Kerb select -From milchick*.kirbi -MatchingSpn .*/LUMON-FS1

Example 7 - Print only tickets #1, 3-5, 7+

Kerb select -From milchick*.kirbi -SeqNbr 1, 3-5, 7-*

Kerb setpw

Sets the password of (another) account

Synopsis

Kerb setpw [options] <TargetAccount> <NewPassword>

Parameters

Name Aliases Value Description
<TargetAccount>   <UserPrincipalName> Optional name of account to set password of
<NewPassword>   <String> New password to set

Options

Name Aliases Value Description
-AuthProxy   <EndPoint> Endpoint of auth proxy
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-Delegate   <SwitchParam> Requests delegation (sends TGT and key for Kerberos)
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-Socks5   <host-or-ip:port> End point of SOCKS 5 server to use
-SpnOverride   <SpnMapping[]> Specifies an SPN override

Authentication

Name Aliases Value Description
-Anonymous   <SwitchParam> Uses anonymous login
-NtlmHash   <hexadecimal hash> NTLM hash for NTLM authentication
-Password -p <String> Password to authenticate with
-UserDomain -ud <String> Domain of user to authenticate with
-UserName -u <UserPrincipalName> User name to authenticate with, not including the domain

Authentication (Kerberos)

Name Aliases Value Description
-AesKey   <HexString> AES key (128 or 256)
-DelegateTicket   <String[]> Sends the tickets (and keys) to the target for delegation
-DesKey   <HexString> DES key
-Kdc   <host-or-ip:port> KDC endpoint
-Keytab   <String> Name of keytab file
-S4ProxyService   <SecurityPrincipalName> Name of service to proxy through
-S4UserCert   <String> Name of file containing a certificate of a user to impersonate with S4U
-S4UserName   <UserPrincipalName> Name of user to impersonate with S4U
-Tgt   <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-TicketCache   <String> Name of ticket cache file
-Tickets -Ticket <String[]> Name of file containing service tickets (.kirbi or ccache)
-U2UserName   <UserPrincipalName> User name to request TGT for U2U
-UserCert   <String> Name of file containing user’s certificate (for PKINIT)
-UserKey   <String> Name of file containing user’s key (for PKINIT)
-UserKeyPassword   <String> Password to decrypt file containing user’s key (for PKINIT)

Authentication (NTLM)

Name Aliases Value Description
-NtlmVersion   <Version> NTLM version number (a.b.c.d)
-Workstation -w <String> Name of workstation to send with NTLM authentication

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint

Output

Name Aliases Value Description
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-Verbose -V <SwitchParam> Prints verbose messages

Details

Kerb setpw uses the Windows 2000 Kerberos Change Password protocol (RFC 3244) and can be used to change the password of a user account that may or may not be the same as the authenticating user. This service does not require an initial ticket and is more flexible than changepw.

Examples

Example 1 - milchick setting his own password

Kerb setpw -UserName milchick@LUMON -Kdc 10.66.0.11 -Password Br3@kr00m! milchick@lumon.ind EradicateFolly!

Example 2 - milchick setting password for marks

Kerb setpw -UserName milchick@LUMON -Kdc 10.66.0.11 -Password Br3@kr00m! marks@lumon.ind SafelySituated

Kerb tgsreq

Requests a ticket from the KDC.

Synopsis

Kerb tgsreq [options] -Target <SecurityPrincipalName[]> <Kdc> <Target>

Parameters

Name Aliases Value Description
<Kdc>   <EndPoint> Host name or address of KDC
-Target   <SecurityPrincipalName[]> SPN(s) to request ticket(s) for

Options

Name Aliases Value Description
-ArmorTicket   <String> Name of file containing armor ticket
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-Forwarded   <SwitchParam> Requests a forwarded ticket
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True
-Realm   <String> Realm of the KDC
-S4ProxyService   <SecurityPrincipalName> Name of service account with S4U2proxy
-S4UserName   <UserPrincipalName> Name of user to impersonate with S4U
-ServicePassword   <String> Password for service account (for decrypting authorization data)
-Socks5   <host-or-ip:port> End point of SOCKS 5 server to use
-TicketComment   <String> Comment to associate with ticket
-U2uTicket   <String> Name of file containing U2U ticket

Authentication (Kerberos)

Name Aliases Value Description
-EncTypes   <EType[]> Encryption types to request in response
      Possible values:
      DesCbcMd5
      DesCbcCrc
      Rc4Hmac
      Rc4HmacExp
      Aes128CtsHmacSha1_96
      Aes256CtsHmacSha1_96
      DsaWithSha1
      Md5WithRsa
      Sha1WithRsa
      Rc2Cbc
      Rsa
      RsaesOaep
      DesEde3Cbc
-EndTime   <DateTime> End time
-Forwardable   <SwitchParam> Requests a forwardable ticket
-Postdate   <DateTime> Requests a postdated ticket with the specified start date
-Proxiable   <SwitchParam> Requests a forwardable ticket
-Renewable   <SwitchParam> Requests a renewable ticket
-RenewableOk   <SwitchParam> Accepts a renewable ticket if the end time is over the limit
-RenewTill   <DateTime> Requests a ticket renewable until the specified time (implies -Renewable)
-S4UserCert   <String> Name of file containing a certificate of a user to impersonate with S4U
-Target   <SecurityPrincipalName[]> SPN(s) to request ticket(s) for
-Tgt   <String> Name of file containing a ticket-granting ticket (.kirbi or ccache)
-TicketCache   <String> Name of ticket cache file
-W, -Workstation   <String> Name of client workstation

Connection

Name Aliases Value Description
-HostAddress -ha <String[]> Network address(es) of the server
-UseTcp4Only -4 <SwitchParam> Only use TCP over IPv4 endpoint
-UseTcp6Only -6 <SwitchParam> Only use TCP over IPv6 endpoint

Output

Name Aliases Value Description
-Append   <SwitchParam> Appends to the output file, if it exists
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-OutputFileName   <String> Name of file to write ticket to
-Overwrite   <SwitchParam> Overwrites the output file, if it exists
-Verbose -V <SwitchParam> Prints verbose messages

Ticket Authorization Data (Kerberos)

Name Aliases Value Description
-AsrepKey   <HexString> Encryption key from AS-REP (for decryption NTLM hash)
-ServiceSalt   <String> Salt for service account (for decrypting authorization data)

Details

This command sends a TGS-REQ to the KDC to request a ticket.

The target may either be specified as a service principal name of the form <class>/<instance> or as the name of the account itself. For machine accounts, the $ is optional. For instance, instead of host/LUMON-FS1, you may simply use LUMON-FS1$ or LUMON-FS1

The command line must include either a password or a hex-encoded key that is used both for pre-authentication as well as to decrypt the response. When specifying the NTLM hash, specify just the NTLM portion with no colon.

By default, all supported encryption types are sent in the request. To limit this, use the -EncTypes parameter to specify which encryption types to request from the server.

Examples

Example 1 - Requesting a ticket for SMB

Kerb tgsreq -Kdc 10.66.0.11 -Tgt milchick-tgt.kirbi cifs/LUMON-FS1 -OutputFile milchick-LUMON-FS1.kirbi

Example 2 - Requesting a ticket for LUMON-FS1

Kerb tgsreq -Kdc 10.66.0.11 -Tgt milchick-tgt.kirbi LUMON-FS1 -OutputFile milchick-LUMON-FS1.kirbi

Example 3 - Requesting a ticket for SMB and Host

Kerb tgsreq -Kdc 10.66.0.11 -Tgt milchick-tgt.kirbi cifs/LUMON-FS1, HOST/LUMON-FS1 -OutputFile milchick-LUMON-FS1.kirbi

Example 4 - Requesting a U2U ticket

Kerb tgsreq -Kdc 10.66.0.11 -v -Tgt allentown-tgt.kirbi -Overwrite -U2u allentown-tgt.kirbi -OutputFileName allentown-u2u.kirbi host/allentown

Example 5 - Requesting a U2U ticket and extracting NTLM hash

Kerb tgsreq -Kdc 10.66.0.11 -v -Tgt allentown-tgt.kirbi -Overwrite -U2u allentown-tgt.kirbi -OutputFileName allentown-u2u.kirbi host/allentown -AsrepKey 82d4ab5873cbfda126e00c28edb5bd97b6451aa06a291d85173e6fc4ed4aacee

Kerb keytab list

Lists the entries in a keytab file

Synopsis

Kerb keytab list [options] <Keytab>

Parameters

Name Aliases Value Description
<Keytab>   <String> Name of keytab file

Options

Name Aliases Value Description
-ConsoleOutputStyle -OutputStyle <OutputStyle> Determines the output style
      Possible values:
      Freeform
      Raw
      Table
      List
      Csv
      Tsv
      Json
      TreeTable
-OutputFields   <String[]> Fields to display in output
      Possible values:
      Principal
      Realm
      Timestamp
      Kvno
      EType
      KeyText
-OutputHeaders   <SwitchParam> Print headers for table/list/CSV/TSV styles
      Default: True

Output

Name Aliases Value Description
-ConsoleLogFormat -LogFormat <LogFormat> Sets the format of log messages written to the console
      Default: 0
      Possible values:
      Text
      TextWithTimestamp
      Json
-DebugLog -vvv <SwitchParam> Prints debug messages
-Diagnostic -vv <SwitchParam> Prints diagnostic messages
-H, -HumanReadable   <SwitchParam> Formats file sizes as human-readable values
-LogLevel   <LogMessageSeverity> Sets the lowest level of messages to log
      Possible values:
      Debug
      Diagnostic
      Verbose
      Info
      Warning
      Error
      Critical
-Verbose -V <SwitchParam> Prints verbose messages