Kerberos Brute Force Attack: AD Exploitation

“Brute-forcing Kerberos is possible due to distinct server responses during authentication attempts. Attackers explicitly exploit these pre-authentication responses to enumerate valid usernames purely from the network edge.”

A Domain Controller will tell an anonymous stranger on the internet whether a given username exists. Not by accident and not through a bug — by returning two different error codes to a request that carries no credentials at all. Kerberos Brute Force Attack: AD Exploitation is a deconstruction of that behaviour, and of how much of a corporate directory you can reconstruct over port 88/tcp before you have authenticated to anything.

The Mathematics of Pre-Authentication

The whole technique rests on translating two KDC responses. Throw usernames at a Domain Controller as unauthenticated AS-REQ messages and it answers precisely:

• KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN: no such principal in the directory.
• KRB5KDC_ERR_PREAUTH_REQUIRED: the principal exists; supply pre-authentication data.

Two error codes, and a valid user list falls out of the difference. Because no password is offered, nothing increments the badPwdCount attribute and no account lockout policy engages — which is the property that makes this safe to run against a client’s production domain when a password spray would not be.

There is a detail the guide is right to dwell on: an account with pre-authentication disabled returns neither of these. It returns an encrypted TGT, which is an AS-REP Roastable hash you can take away and crack offline. So the same sweep that builds your user list also fingerprints the accounts worth attacking next, in one pass.

The Enumeration Arsenal

From there it is execution, with syntax across the tools people actually use:

• Kerbrute: A Go implementation fast enough to sweep tens of thousands of names in minutes. The claim that it evades monitoring deserves qualification — it generates Event ID 4768 with failure code 0x6 on the DC for every miss, so it is invisible only against organisations not collecting or not alerting on those. That is most of them, which is a defensive gap rather than a property of the tool.
• Impacket and Rubeus: Enumeration folded into wider Python and C# workflows, so the user list feeds straight into roasting and ticket manipulation rather than sitting in a text file.
• Metasploit: kerberos_enumusers and kerberos_login for mapping valid principals and flagging which ones are AS-REP Roastable.

The cost of speed is the shape of the traffic. Thousands of AS-REQ messages from a single source address inside a few seconds looks nothing like human behaviour on the wire, so pacing the sweep across hours and multiple source addresses is what separates an assessment finding from an operation. Slower is quieter, and quieter takes days.

Who Is This Book REALLY For?

• External penetration testers: Facing a VPN portal or an exposed DC with nothing but a company name, a Kerbrute sweep against a list built from LinkedIn naming conventions is the fastest route to a validated target list — and the one least likely to lock out a real employee at nine on a Monday.
• SOC and threat hunters: Failed Kerberos requests are constant background noise, which is exactly the cover the technique relies on. The signal is not the individual event; it is velocity and the ratio of unknown-principal failures to successes from one source. Alerting on volume alone will bury you.
• Active Directory administrators: Confirmation that the protocol is talkative by design, that no lockout policy will save you here, and that a Domain Controller reachable from an untrusted segment is an architectural decision with consequences you cannot configure away.

The Bottom Line

Kerberos Brute Force Attack: AD Exploitation shows a protocol being turned against itself using nothing but its own error handling. The uncomfortable part is that there is no patch — distinguishing an unknown principal from a known one is what the specification requires. All you can do is watch, and most organisations are not.