KrbRelayEx: A Kerberos Relaying Tool for Penetration Testing

KrbRelayEx is an open-source tool designed for security professionals to assess the security of Active Directory environments. It leverages the power of Kerberos relaying, a technique that exploits the trust relationship between clients and servers, to gain unauthorized access to resources.

What is Kerberos Relaying?

Kerberos is an authentication protocol widely used in Windows networks to verify user identities. In a typical Kerberos flow, a user requests a “ticket” from a domain controller to access a specific service. This ticket acts as a temporary pass, proving the user’s identity to the service.

Kerberos relaying attacks exploit this process by intercepting the ticket and forwarding it to another service. This allows the attacker to impersonate the user and gain access to resources they shouldn’t have access to.

How KrbRelayEx Works:

The tool was developed to explore privilege exploitation within Active Directory environments, particularly focusing on the DnsAdmins group. Members of this group hold elevated privileges, allowing them to modify DNS records, which is critical for the functioning of corporate networks. Surprisingly, despite its significance, this vector remains underdocumented aside from isolated cases like CVE-2021-40469.

KrbRelayEx acts as a man-in-the-middle (MitM), intercepting communication between a client and a server. It specifically targets Kerberos AP-REQ tickets, which are used to authenticate to services like SMB shares or Active Directory Certificate Services (ADCS) endpoints.

Here’s a simplified breakdown:

1. Intercepting the Ticket: KrbRelayEx listens for incoming SMB connections from a client attempting to access a server.
2. Relaying the Ticket: When the client sends its Kerberos ticket, KrbRelayEx captures it and forwards it to the target server.
3. Gaining Access: The server, seeing a valid ticket, grants access to the attacker, who is now impersonating the client.

Why is KrbRelayEx Important?

KrbRelayEx was developed to highlight the potential risks associated with misconfigured DNS settings and the privileges granted to certain groups, like the DnsAdmins group, in Active Directory. By exploiting DNS vulnerabilities, attackers can redirect traffic to their machine, enabling them to perform Kerberos relaying attacks.

Key Features of KrbRelayEx:

• Versatile Relaying: Relays Kerberos tickets to access various services like SMB and ADCS.
• Interactive Consoles: Provides interactive SMB consoles for managing multiple connections and manipulating files.
• Port Forwarding: Supports multithreaded port forwarding to redirect traffic for services like RDP, HTTP(S), and WinRM.⁶
• Cross-Platform Compatibility: Works on both Windows and Linux.

Important Disclaimer:

KrbRelayEx is a powerful tool with the potential for misuse. It is exclusively intended for ethical hacking, penetration testing, and security research with proper authorization. Any unauthorized use is strictly prohibited.

Using KrbRelayEx responsibly helps organizations identify and address vulnerabilities in their Active Directory infrastructure, strengthening their defenses against real-world attacks.

For more details and to access the tool, visit the official KrbRelayEx GitHub repository.