> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/kerberos-fundamentals.md).

# Kerberos Fundamentals

**The core idea:** Kerberos is a ticket-based authentication protocol. You never send your password over the network more than once (at initial login) — instead you carry around cryptographic "tickets" that prove your identity to individual services.

### The Three-Step Exchange

1. **AS-REQ / AS-REP (Authentication Service):** you send your username to the Domain Controller's KDC (Key Distribution Center). If successful, you get back a **TGT (Ticket Granting Ticket)** — encrypted with the KDC's own secret key (the `krbtgt` account's key), so you can't read or forge it yourself.
2. **TGS-REQ / TGS-REP (Ticket Granting Service):** you present your TGT back to the KDC and ask for a **Service Ticket (ST)** for a specific resource (e.g. "the LDAP service on `dc1.domain.htb`"). The KDC issues an ST encrypted with *that service's* key.
3. **AP-REQ:** you hand the ST directly to the target service, which decrypts it with its own key and trusts that the KDC vouched for you.

### Worked Example

```bash
# Step 1: get a TGT for jane.doe
getTGT.py domain.htb/jane.doe:'Password123' -dc-ip 10.10.10.5
export KRB5CCNAME=jane.doe.ccache

# Step 2 + 3 happen automatically inside tools like nxc/evil-winrm
# when you pass -k (use Kerberos) and point KRB5CCNAME at your ticket
nxc smb dc1.domain.htb -k --use-kcache --shares
```

### Two Properties That Trip People Up

**Time sensitivity:** Kerberos tickets include a timestamp to prevent replay attacks. If your clock differs from the KDC's by more than \~5 minutes (the default `maxClockSkew` policy), every ticket you request is rejected with `KRB_AP_ERR_SKEW`, even with perfectly correct credentials.

```bash
sudo ntpdate -u 10.10.10.5
sudo timedatectl set-ntp false   # stop it auto-resyncing away from the target's time
```

**Hostname sensitivity:** every service ticket is bound to a **Service Principal Name (SPN)** — a string like `ldap/dc1.domain.htb`. SPNs are registered against hostnames, not IP addresses. Requesting a ticket for `ldap/10.10.10.5` will fail with `KDC_ERR_S_PRINCIPAL_UNKNOWN`, because no such SPN was ever registered — you must use the actual hostname the SPN was created with.

```bash
# fails - no SPN registered against a bare IP
certipy-ad req ... -target 10.10.10.5

# works - matches the real SPN
certipy-ad req ... -target dc1.domain.htb
```

### Key Terms

| Term         | Definition                                                                                  |
| ------------ | ------------------------------------------------------------------------------------------- |
| **TGT**      | Ticket Granting Ticket — proves your identity to the KDC for the rest of a Kerberos session |
| **ST / TGS** | Service Ticket — proves your identity to one specific service                               |
| **KDC**      | Key Distribution Center — the DC component that issues Kerberos tickets                     |
| **SPN**      | Service Principal Name — identifies a service instance, tied to a hostname                  |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/kerberos-fundamentals.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.