Active › Module 3 › Lesson 4
Lab — Kerberos
Pack ticket, TGT/TGS flow, and SPN cards — Kerberos literacy file from $LAB_AD only.
Visual · t25_kerberos_lab
Lab: Kerberos pack. $LAB_AD only. Original Cyberlium.
Opening
Kerberos pack connects tickets to SPN hygiene — paperwork before enum module.
Lessons 3-1–3-3 covered tickets, TGT/TGS exchanges, and SPN hygiene. This lab merges ticket card, flow diagram, and SPN card with optional 4768/4769 event note from YOUR lab SIEM or course material. No ticket theft or roast execution. Next: Quiz — Kerberos Literacy.
1. Lab contract: Kerberos pack
Create $HOME/cyberlium-lab/t25-m03-l04-kerberos-lab.txt merging ticket card, TGT/TGS diagram, SPN hygiene card, and lab forest name.
Optional: map 4768/4769 to TGT/TGS in a two-row table from course docs.
Command guide
Try these commands — Lab contract: Kerberos pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Kerberos port 88 — https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview Nmap Kerberos — https://nmap.org/nsedoc/scripts/krb5-enum-users.html (script literacy — lab host only) MITRE T1558 — https://attack.mitre.org/techniques/T1558/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install dnsutils
macOS:
Command — copy this
brew install nmap brew install bind
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Built-in: nslookup (or install BIND for dig)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t25-ad/lab.env" 2>/dev/null || export LAB_AD_HOST=${LAB_AD_HOST:-127.0.0.1}
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
grep LAB_AD_HOST "$LAB_AD/roe.txt"nmap YOUR lab DC only — never scan stranger networks
Command — copy this
nmap -Pn -p 88,464 "$LAB_AD_HOST" 2>/dev/null | grep -E 'PORT|open|88|464' | head -8
dig +short -t srv _kerberos._tcp.${LAB_AD_DOMAIN:-lab.local} @"$LAB_AD_HOST" 2>/dev/null || echo 'Kerberos SRV lookup on LAB_AD_HOST only'Primary tools to practice this lesson: nmap, dig. Reference sites: Kerberos port 88 (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview); Nmap Kerberos (https://nmap.org/nsedoc/scripts/krb5-enum-users.html); MITRE T1558 (https://attack.mitre.org/techniques/T1558/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for Rubeus, roast, golden ticket recipes, production captures — remove. Pack stays naming and mitigations only.
If lab AD rebuilt, update SPN examples to match new map.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Enum Literacy.
Kerberos literacy feeds LDAP and BloodHound graph lessons in M4.
4. What you ship: Kerberos literacy pack for $LAB_AD
Merged ticket, flow, SPN sections. $LAB_AD named. NO roast/forgery content. chmod 600.
5. What you record before the next lesson
Date. Kerberos pack path. $LAB_AD named. File t25-m03-l04-kerberos-lab.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Attach Kerberoast command output from stranger domain. Include krbtgt hash in pack.
Right
Write YOUR Kerberos pack for $LAB_AD. chmod 600. Next: Quiz — Kerberos Literacy.
Mission: freeze YOUR Kerberos pack
1) Merge M3 literacy sections. 2) Confirm zero roast/forgery commands. 3) Link one event ID to TGT or TGS. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Mitigation tables beside flow diagrams read well in purple reports.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Kerberos pack should document mitigations not attack commands.
True or False
Knowledge Check
APPLY: 4769 events primarily relate to:
Multiple choice