Kerberoast
Extract and crack Kerberos service tickets from Active Directory to identify weak user passwords through offline analysis.
Instructions
The goal of Kerberoasting is to harvest TGS tickets for services that run on behalf of user accounts in the AD, not computer accounts. Thus, part of these TGS tickets is encrypted with keys derived from user passwords. As a consequence, their credentials could be cracked offline.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ips | Yes | ||
| usernames | Yes | ||
| passwords | Yes | ||
| output_file | Yes |
Implementation Reference
- src/pentestmcp/server.py:246-252 (handler)The handler function for the 'Kerberoast' tool. It prepends the project directory to the output_file path and executes netexec ldap with the --kerberoast option, providing usernames and optional passwords to harvest TGS tickets for offline cracking.@mcp.tool(name="Kerberoast",description="The goal of Kerberoasting is to harvest TGS tickets for services that run on behalf of user accounts in the AD, not computer accounts. Thus, part of these TGS tickets is encrypted with keys derived from user passwords. As a consequence, their credentials could be cracked offline.") def kerberoast(ips:List[str],usernames,passwords,output_file:str): output_file=config.PROJECT_DIRECTORY+output_file if len(passwords)>0: return run_command(["netexec","ldap"]+ips+["-u",usernames,"-p",passwords,"--kerberoast",output_file]) return run_command(["netexec","ldap"]+ips+["-u",usernames,"--kerberoast",output_file])
- src/pentestmcp/server.py:246-246 (registration)The @mcp.tool decorator registers the 'kerberoast' function as the 'Kerberoast' tool with MCP, including its description.@mcp.tool(name="Kerberoast",description="The goal of Kerberoasting is to harvest TGS tickets for services that run on behalf of user accounts in the AD, not computer accounts. Thus, part of these TGS tickets is encrypted with keys derived from user passwords. As a consequence, their credentials could be cracked offline.")
- src/pentestmcp/server.py:28-85 (helper)The run_command helper function used by the Kerberoast handler to execute the netexec command and handle its output, errors, and timeouts.def run_command(command: List[str], timeout: int = 150,communicate:bool=False) -> Dict[str, Union[str, int, bool]]: try: logger.info(f"communicate :{communicate}") logger.info(f"Running command: {' '.join(command)}") if communicate: # Use Popen for interactive communication process = subprocess.Popen( command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, text=True ) stdout, stderr = process.communicate(input="y\n", timeout=timeout) returncode = process.returncode else: # Use run for non-interactive commands result = subprocess.run( command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=True, timeout=timeout ) stdout = result.stdout stderr = result.stderr returncode = result.returncode logger.info(f"Command completed with return code {returncode}") return { "success": True, "stdout": stdout, "stderr": stderr, "returncode": returncode } except subprocess.CalledProcessError as e: logger.error(f"Command failed with return code {e.returncode}: {e.stderr}") return { "success": False, "stdout": e.stdout, "stderr": e.stderr, "returncode": e.returncode, "error": f"Command failed with return code {e.returncode}" } except subprocess.TimeoutExpired as e: logger.error(f"Command timed out after {timeout} seconds") return { "success": False, "error": f"Command timed out after {timeout} seconds" } except Exception as e: logger.error(f"Error running command: {str(e)}") return { "success": False, "error": str(e) }