Lab — Kerberos — Active Directory Attacks

Visual · t25_kerberos_lab

Lab: Kerberos pack. $LAB_AD only. Original Cyberlium.

Kerberos pack connects tickets to SPN hygiene — paperwork before enum module.

Lessons 3-1–3-3 covered tickets, TGT/TGS exchanges, and SPN hygiene. This lab merges ticket card, flow diagram, and SPN card with optional 4768/4769 event note from YOUR lab SIEM or course material. No ticket theft or roast execution. Next: Quiz — Kerberos Literacy.

1. Lab contract: Kerberos pack

Create $HOME/cyberlium-lab/t25-m03-l04-kerberos-lab.txt merging ticket card, TGT/TGS diagram, SPN hygiene card, and lab forest name.

Optional: map 4768/4769 to TGT/TGS in a two-row table from course docs.

Command guide

Try these commands — Lab contract: Kerberos pack

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Kerberos port 88 — https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview Nmap Kerberos — https://nmap.org/nsedoc/scripts/krb5-enum-users.html (script literacy — lab host only) MITRE T1558 — https://attack.mitre.org/techniques/T1558/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install nmap
sudo apt install dnsutils

macOS:

Command — copy this

brew install nmap
brew install bind

Windows:

Command — copy this

choco install nmap  # or download https://nmap.org/download.html

Built-in: nslookup (or install BIND for dig)

═══ LINUX / macOS ═══

Command — copy this

source "$HOME/cyberlium-lab/t25-ad/lab.env" 2>/dev/null || export LAB_AD_HOST=${LAB_AD_HOST:-127.0.0.1}
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
grep LAB_AD_HOST "$LAB_AD/roe.txt"

nmap YOUR lab DC only — never scan stranger networks

Command — copy this

nmap -Pn -p 88,464 "$LAB_AD_HOST" 2>/dev/null | grep -E 'PORT|open|88|464' | head -8
dig +short -t srv _kerberos._tcp.${LAB_AD_DOMAIN:-lab.local} @"$LAB_AD_HOST" 2>/dev/null || echo 'Kerberos SRV lookup on LAB_AD_HOST only'

Primary tools to practice this lesson: nmap, dig. Reference sites: Kerberos port 88 (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview); Nmap Kerberos (https://nmap.org/nsedoc/scripts/krb5-enum-users.html); MITRE T1558 (https://attack.mitre.org/techniques/T1558/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Cross-check ethics

Grep for Rubeus, roast, golden ticket recipes, production captures — remove. Pack stays naming and mitigations only.

If lab AD rebuilt, update SPN examples to match new map.

3. Lock the proof

chmod 600 on the pack. Quiz next — then Enum Literacy.

Kerberos literacy feeds LDAP and BloodHound graph lessons in M4.

4. What you ship: Kerberos literacy pack for $LAB_AD

Merged ticket, flow, SPN sections. $LAB_AD named. NO roast/forgery content. chmod 600.

5. What you record before the next lesson

Date. Kerberos pack path. $LAB_AD named. File t25-m03-l04-kerberos-lab.txt chmod 600.

6. Wrong vs right: stranger-domain attacks vs lab AD literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Attach Kerberoast command output from stranger domain. Include krbtgt hash in pack.
Right: Write YOUR Kerberos pack for $LAB_AD. chmod 600. Next: Quiz — Kerberos Literacy.

Hands-on Exercise

Mission: freeze YOUR Kerberos pack

1) Merge M3 literacy sections. 2) Confirm zero roast/forgery commands. 3) Link one event ID to TGT or TGS. 4) chmod 600.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

Mitigation tables beside flow diagrams read well in purple reports.

Practice QuizQuestion 1

Multiple choice

APPLY: This lab requires:

Practice QuizQuestion 2

True or False

APPLY: True or False: Kerberos pack should document mitigations not attack commands.

Practice QuizQuestion 3

Multiple choice

APPLY: 4769 events primarily relate to: