Pentesting Tools

KrbRelayEx : Mastering Kerberos Ticket Relay Attacks In Active Directory Environments

KrbRelayEx is a sophisticated tool designed for performing Man-in-the-Middle (MitM) attacks by relaying Kerberos AP-REQ tickets.

It is particularly useful in scenarios where an attacker seeks to exploit vulnerabilities in Active Directory environments, especially those related to DNS manipulation and Kerberos authentication.

Key Features Of KrbRelayEx

  • Kerberos AP-REQ Ticket Relay: The tool captures and relays Kerberos authentication tickets to access SMB shares or HTTP Active Directory Certificate Services (ADCS) endpoints on behalf of the victim.
  • Fake RPC/DCOM Server: KrbRelayEx implements a fake RPC/DCOM server that listens for authenticated requests, extracts dynamic port bindings, and forwards victim requests transparently.
  • Cross-Platform Compatibility: Built with .NET 8.0, it supports both Windows and GNU/Linux platforms.
  • Multithreaded Operations: Offers interactive or background SMB consoles for managing multiple connections and supports multithreaded port forwarding for additional traffic.

Usage And Scenarios

  1. Interactive SMB Console: bashKrbRelayEx.exe -spn CIFS/target.domain.com -console -redirecthost <ip_target_host>
  2. List SMB Shares: bashKrbRelayEx.exe -spn CIFS/target.domain.com -list
  3. Dump SAM & LSA Secrets: bashKrbRelayEx.exe -spn CIFS/target.domain.com -secrets -redirecthost <ip_target_host>

Exploitation Scenarios

  • DnsAdmins Group: Members can modify DNS records, enabling DNS spoofing attacks.
  • Insecure DNS Updates: Allows unauthorized DNS updates, potentially leading to domain takeover.
  • HOSTS File Manipulation: Redirects hostname-based traffic by modifying client HOSTS files.

Important Considerations

  • Legitimate Use Only: This tool is intended for authorized penetration testing and security research purposes.
  • Configuration: Ensure proper configuration of HOSTS file entries to target IP addresses.

To use KrbRelayEx, you need to install the .NET 8.0 runtime. On Windows, download from the official .NET site, and on Ubuntu, use sudo apt install dotnet8.

Required files include KrbRelayEx.dll, KrbRelayEx.runtimeconfig.json, and optionally KrbRelayEx.exe for Windows.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

How Does a Firewall Work Step by Step

How Does a Firewall Work Step by Step? What Is a Firewall and How Does…

1 day ago

ROADTools: The Modern Azure AD Exploration Framework

ROADTools is a powerful framework designed for exploring and interacting with Microsoft Azure Active Directory…

4 days ago

How to Enumerate Microsoft 365 Groups Using PowerShell and Python

Microsoft 365 Groups (also known as M365 Groups or Unified Groups) are at the heart…

4 days ago

SeamlessPass: Using Kerberos Tickets to Access Microsoft 365

SeamlessPass is a specialized tool designed to leverage on-premises Active Directory Kerberos tickets to obtain…

5 days ago

PPLBlade: Advanced Memory Dumping and Obfuscation Tool

PPLBlade is a powerful Protected Process Dumper designed to capture memory from target processes, hide…

5 days ago

HikPwn : Simple Scanner For Hikvision Devices With Basic Vulnerability Scanning

HikPwn: Comprehensive Guide to Scanning Hikvision Devices for Vulnerabilities If you’re searching for an efficient…

6 days ago