KrbRelayEx is a sophisticated tool designed for performing Man-in-the-Middle (MitM) attacks by relaying Kerberos AP-REQ tickets.
It is particularly useful in scenarios where an attacker seeks to exploit vulnerabilities in Active Directory environments, especially those related to DNS manipulation and Kerberos authentication.
Key Features Of KrbRelayEx
- Kerberos AP-REQ Ticket Relay: The tool captures and relays Kerberos authentication tickets to access SMB shares or HTTP Active Directory Certificate Services (ADCS) endpoints on behalf of the victim.
- Fake RPC/DCOM Server: KrbRelayEx implements a fake RPC/DCOM server that listens for authenticated requests, extracts dynamic port bindings, and forwards victim requests transparently.
- Cross-Platform Compatibility: Built with .NET 8.0, it supports both Windows and GNU/Linux platforms.
- Multithreaded Operations: Offers interactive or background SMB consoles for managing multiple connections and supports multithreaded port forwarding for additional traffic.
Usage And Scenarios
- Interactive SMB Console: bash
KrbRelayEx.exe -spn CIFS/target.domain.com -console -redirecthost <ip_target_host> - List SMB Shares: bash
KrbRelayEx.exe -spn CIFS/target.domain.com -list - Dump SAM & LSA Secrets: bash
KrbRelayEx.exe -spn CIFS/target.domain.com -secrets -redirecthost <ip_target_host>
Exploitation Scenarios
- DnsAdmins Group: Members can modify DNS records, enabling DNS spoofing attacks.
- Insecure DNS Updates: Allows unauthorized DNS updates, potentially leading to domain takeover.
- HOSTS File Manipulation: Redirects hostname-based traffic by modifying client HOSTS files.
Important Considerations
- Legitimate Use Only: This tool is intended for authorized penetration testing and security research purposes.
- Configuration: Ensure proper configuration of HOSTS file entries to target IP addresses.
To use KrbRelayEx, you need to install the .NET 8.0 runtime. On Windows, download from the official .NET site, and on Ubuntu, use sudo apt install dotnet8.
Required files include KrbRelayEx.dll, KrbRelayEx.runtimeconfig.json, and optionally KrbRelayEx.exe for Windows.
.webp "ELFEN – Linux Malware Analysis Sandbox")
 attacks by relaying Kerberos AP-REQ tickets.){kind=link}