gssapi-abuse was released as part of my DEF CON 31 talk. A full write up on the abuse vector can be found here: A Broken Marriage: Abusing Mixed Vendor Kerberos Stacks

The tool has two features. The first is the ability to enumerate non Windows hosts that are joined to Active Directory that offer GSSAPI authentication over SSH.

The second feature is the ability to perform dynamic DNS updates for GSSAPI abusable hosts that do not have the correct forward and/or reverse lookup DNS entries.

GSSAPI based authentication is strict when it comes to matching service principals, therefore DNS entries should match the service principal name both by hostname and IP address.


gssapi-abuse requires a working krb5 stack along with a correctly configured krb5.conf.


On Windows hosts, the MIT Kerberos software should be installed in addition to the python modules listed in requirements.txt, this can be obtained at the MIT Kerberos Distribution Page.

Windows krb5.conf can be found at C:\ProgramData\MIT\Kerberos5\krb5.conf


The libkrb5-dev package needs to be installed prior to installing python requirements


Once the requirements are satisfied, you can install the python dependencies via pip/pip3 tool

pip install -r requirements.txt

Enumeration Mode

The enumeration mode will connect to Active Directory and perform an LDAP search for all computers that do not have the word Windows within the Operating System attribute.

Once the list of non Windows machines has been obtained, gssapi-abuse will then attempt to connect to each host over SSH and determine if GSSAPI based authentication is permitted.


python .\ -d enum -u john.doe -p SuperSecret!
[=] Found 2 non Windows machines registered within AD
[!] Host does not have GSSAPI enabled over SSH, ignoring
[+] Host has GSSAPI enabled over SSH

DNS Mode

DNS mode utilises Kerberos and dnspython to perform an authenticated DNS update over port 53 using the DNS-TSIG protocol.

Currently dns mode relies on a working krb5 configuration with a valid TGT or DNS service ticket targetting a specific domain controller, e.g. DNS/dc1.victim.local.


Adding a DNS A record for host

python .\ -d dns -t ahost -a add --type A --data
[+] Successfully authenticated to DNS server
[=] Adding A record for target ahost using data
[+] Applied 1 updates successfully

Adding a reverse PTR record for host Notice that the data argument is terminated with a ., this is important or the record becomes a relative record to the zone, which we do not want.

We also need to specify the target zone to update, since PTR records are stored in different zones to A records.

python .\ -d dns --zone -t 50 -a add --type PTR --data
[+] Successfully authenticated to DNS server
[=] Adding PTR record for target 50 using data
[+] Applied 1 updates successfully

Forward and reverse DNS lookup results after execution




Published by Tamil S

Tamil has a great interest in the fields of Cyber Security, OSINT, and CTF projects. Currently, he is deeply involved in researching and publishing various security tools with Kali Linux Tutorials, which is quite fascinating.

Leave a comment

Your email address will not be published. Required fields are marked *