Skip to content

Conversation

Marshall-Hallenbeck
Copy link
Collaborator

@Marshall-Hallenbeck Marshall-Hallenbeck commented Sep 3, 2025

Description

  • Allows defining a list of users to kerberoast instead of kerberoasting all users
  • Also moves the get_conditional_action function we use in several protocols to a helper function.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Deprecation of feature or functionality
  • This change requires a documentation update
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Setup guide for the review

Nothing special needed

Screenshots (if appropriate):

image

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

  • I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
  • New and existing e2e tests pass locally with my changes
  • If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

@Marshall-Hallenbeck Marshall-Hallenbeck self-assigned this Sep 3, 2025
@Marshall-Hallenbeck Marshall-Hallenbeck added the enhancement New feature or request label Sep 3, 2025
@Marshall-Hallenbeck
Copy link
Collaborator Author

@NeffIsBack Redid the PR here.

@NeffIsBack
Copy link
Member

Code Looks good so far, gonna test on Sunday evening/monday


# build search filter for specific users
user_filter = "".join([f"(sAMAccountName={username})" for username in target_usernames])
searchFilter = f"(&(servicePrincipalName=*)(!(objectCategory=computer))(|{user_filter}))"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The question would be if we would want to also allow kerberoasting computer accounts if specifically requested. Could be useful in scenarios where you have a manually set password for example

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could add that in the future, or add a flag, but this just uses our current searchFilter but appends the users we want to kerberoast. I feel like that could be something we add later if people really want it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants