KERBEROS

PRIMARY CATEGORY → WINDOWS MOVEMENT

Components ⟡

• 
  • OVERPASS THE HASH
• 
  • PASS THE KEY - PtK
• 
  • PASS THE TICKET - PtT
• 
  • PASS THE CACHE
• 
  • PASS THE CERT - PtC
• 
  • ASREPROAST
• 
  • KERBEROAST
• 
  • DELEGATIONS
• 
  • SHADOW CREDENTIALS
• 
  • UNPAC THE HASH
• 
  • FORGED TICKETS
• 
  • KRB RELAY
• 
  • SAMACCOUNTNAME SPOOFING

---

Workflow

---

Date Sync with a DC

NTPDate

NTPDate

ntpdate '<DC>'
ntpdate -u '<DC>' # Random Source Port to bypass Firewall Restrictions

RDate

RDate

rdate -n '<DC>'

Manually Sync

If date sync with the DC does not work using the tools above, get the Server Time of the DC and set the system date manually as follows

It can be extracted from a NMAP Scan or from a DC’s Kerberos Response Packet (STime Field)

Setting up the Network Filter

• TShark

tshark --interface '<IFACE>' -l --display-filter 'ip.src == <DC_IP> and tcp.port == 88' -T fields -e 'kerberos.stime'

e.g.

tshark --interface 'eth0' -l --display-filter 'ip.src == 10.10.10.5 and tcp.port == 88' -T fields -e 'kerberos.stime'

Expected Output

Running as user "root" and group "root". This could be dangerous.
Capturing on 'eth0'
 
 
Jul 15, 2026 01:56:25.000000000 CEST

Generating Kerberos Traffic

e.g. AS Exchange with kinit

kinit <PRINCIPAL>@<DOMAIN>

e.g.

kinit john.doe@DOMAIN.INTERNAL

Synchronizing the time manually

sudo date -u -s "YYYY-MM-DD HH:MM:SS UTC"

e.g.

sudo date -u -s "2026-07-15 01:56:25 UTC"