文章总结： 本文介绍了几种Rust语言中处理Kerberos协议的工具。klist2kirbi可将票据输出转换为kirbi格式；kerasktgt与kerasktgs用于请求票据授予票据（TGT）和服务（TGS）；Kerforce和kerspray分别用于暴力破解和密码喷洒攻击；kerticket则能查看并转换票据信息。
综合评分： 65
文章分类： 红队,渗透测试,二进制安全,安全工具

Rust 中使用 Kerberos

TtTeam

2026年3月21日 09:10
中国香港

klist2kirbi 将 Klist 命令的输出转换为 kirbi 格式

ServiceName &nbsp; &nbsp; &nbsp; &nbsp;: krbtgtTargetName (SPN) &nbsp; : krbtgtClientName &nbsp; &nbsp; &nbsp; &nbsp; : SA-MONITORINGDomainName &nbsp; &nbsp; &nbsp; &nbsp; : ATTACKRANGE.LOCALTargetDomainName &nbsp; : ATTACKRANGE.LOCALAltTargetDomainName: ATTACKRANGE.LOCALTicket Flags &nbsp; &nbsp; &nbsp; :&nbsp;0x40e10000&nbsp;->&nbsp;forwardable renewable&nbsp;initial&nbsp;pre_authent name_canonicalizeSession Key &nbsp; &nbsp; &nbsp; &nbsp;: KeyType&nbsp;0x12&nbsp;-&nbsp;AES-256-CTS-HMAC-SHA1-96&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: KeyLength&nbsp;32&nbsp;-&nbsp;17&nbsp;a7 b0&nbsp;95&nbsp;e8 e8 d2&nbsp;9d c9&nbsp;58&nbsp;a8 c6&nbsp;1b b8&nbsp;5b&nbsp;3f fe&nbsp;22&nbsp;84&nbsp;9e&nbsp;27&nbsp;64&nbsp;cc&nbsp;77&nbsp;26&nbsp;a2&nbsp;56&nbsp;0f df&nbsp;98&nbsp;fe&nbsp;17StartTime &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:&nbsp;3/13/2026&nbsp;10:15:43&nbsp;(local)EndTime &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:&nbsp;3/13/2026&nbsp;20:15:43&nbsp;(local)RenewUntil &nbsp; &nbsp; &nbsp; &nbsp; :&nbsp;3/20/2026&nbsp;10:15:43&nbsp;(local)TimeSkew &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : &nbsp;+&nbsp;0:00&nbsp;minute(s)EncodedTicket &nbsp; &nbsp; &nbsp;: (size:&nbsp;1279)0000&nbsp;&nbsp;61&nbsp;82&nbsp;04&nbsp;fb&nbsp;30&nbsp;82&nbsp;04&nbsp;f7:a0&nbsp;03&nbsp;02&nbsp;01&nbsp;05&nbsp;a1&nbsp;13&nbsp;1b &nbsp;a...0...........0010&nbsp;&nbsp;11&nbsp;41&nbsp;54&nbsp;54&nbsp;41&nbsp;43&nbsp;4b&nbsp;52:41&nbsp;4e&nbsp;47&nbsp;45&nbsp;2e&nbsp;4c&nbsp;4f&nbsp;43&nbsp; .ATTACKRANGE.LOC0020&nbsp;&nbsp;41&nbsp;4c a2&nbsp;26&nbsp;30&nbsp;24&nbsp;a0&nbsp;03:02&nbsp;01&nbsp;02&nbsp;a1&nbsp;1d&nbsp;30&nbsp;1b&nbsp;1b &nbsp;AL.&0$.......0..0030&nbsp;&nbsp;06&nbsp;6b&nbsp;72&nbsp;62&nbsp;74&nbsp;67&nbsp;74&nbsp;1b:11&nbsp;41&nbsp;54&nbsp;54&nbsp;41&nbsp;43&nbsp;4b&nbsp;52&nbsp; .krbtgt..ATTACKR0040&nbsp;&nbsp;41&nbsp;4e&nbsp;47&nbsp;45&nbsp;2e&nbsp;4c&nbsp;4f&nbsp;43:41&nbsp;4c a3&nbsp;82&nbsp;04&nbsp;b1&nbsp;30&nbsp;82&nbsp; ANGE.LOCAL....0....

生成有效的Kirbi格式票据：

.\klist2kirbi&nbsp;--klist example.klist&nbsp;--outfile example.kirbi[APPLICATION&nbsp;22]&nbsp;KrbCredBody&nbsp; &nbsp; &nbsp; &nbsp; pvno &nbsp; &nbsp; &nbsp; &nbsp; [0] :&nbsp;5&nbsp; &nbsp; &nbsp; &nbsp; msg_ticket &nbsp; [1] :&nbsp;22&nbsp; &nbsp; &nbsp; &nbsp; tickets &nbsp; &nbsp; &nbsp;[2] :&nbsp;SEQUENCE&nbsp;OF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [APPLICATION&nbsp;1]&nbsp;TicketBody&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; tkt_vno &nbsp;[0] :&nbsp;5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; realm &nbsp; &nbsp;[1] :&nbsp;"ATTACKRANGE.LOCAL"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sname &nbsp; &nbsp;[2] :&nbsp;PrincipalName&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; name_type &nbsp; &nbsp;[0] :&nbsp;2&nbsp;(NtSrvInst)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; name_string &nbsp;[1] :&nbsp;SEQUENCE&nbsp;OF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"krbtgt"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"ATTACKRANGE.LOCAL"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; enc_part [3] :&nbsp;EncryptedData&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; etype &nbsp;[0] :&nbsp;18&nbsp;(AES-256-CTS-HMAC-SHA-196)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; kvno &nbsp; [1] :&nbsp;2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cipher [2] :&nbsp;QekDm3LT7ngk0mBqoiJhhhOJQEU8gjZsB9+6AMyYEz3ehaEwIV71InGGhcH596LyjRic6FaFKJsXcZqsPKKLxMlBNY6IFmnWmlUTposlTVbjvIO4i6tbaZczweMFCg7W5C8gwgScSM4geJyDrriti8b325T9TVzd5TxCWn4MFu4Im0IOo8jA1IGnD8pR7lADPIRhg3cc8NWEY+peeCA/DQ9EJfHYs4GqDDUkUsL9auwdL2Pe9S+JNwD8W7Hxh1cMU361J372cytCkOi/RcCQiXFO+tP09GmlokBSFARCHaXl1glZqRPSqse+s8zgYsoh0EQipguPxckdzYNz5dgYyIGRmYNKPYy7ZZUyqXbb5DBTp/REsJ5CdgKlmyyQ52bV4K0EMjUO3IvPDCDx9SVuH4t/n00ov8+gQECGbxXobvK+jSNUaeg7C8mV01ie2bywtUZEsSg/XQi8zFNgLTMV6QN66mX0scOX7Vd/K8w+i5v44yIJV+fLUZEuFIqZbS9ZHKB7KvL3+o0E1OJ0qjOmQRGiWaBEc1SV20IFt4b0mEVIPKI9H5wOf/OQny9z5BQZfjlRk64VFGnQD22eVGrQZqq+NfcRCk3AG+H5w+TReoN9gKw3RxrwP4QH/DAS2g+rdXEG0Vj5oYPVdMZAsOxPIWq2wRNwKXxi1nv19kfp6AmWMuhDR9q0mnVYnNBfMizDwTjxNB3DY1Yiis7YPMmQtehRs11gxOxVNLd6e14GK6GuVhnTQm0PiM3hDA+jzhSXmGGOLDHtw4dmjaHaZX7ob2qFTgqB9eliDHdwTqeE98TDBj2jNSGIDj+FRUSKGheWPdscnuHt+Lw6laoY/Bv0oRK3qcZBh56rUxK5z5rrBhPHuUKo/rPU31Wzlnqssg54U32MNfhsAcXcXp4Rj42XKmpr8pKCjT+rsKtDS2OvItolnqtJugB1BO4Ui8OeTvVUoGFJQV98TktjDdhcraG9aB8TKHds8gCxHyRe/A8cuA6Fuig0QMf0gNgmYeA7TsuLhYlBYRPIvptjWfpdWySCCXzCaoXDewJmy0cYmKF9noet2yuUeizoHz4vfVQcAYkBX348D3c4OJgbafL4HSTnfES2VBfszoHqZvaPm37jQJk4pKVX1c02cKqMENEXI+u1bpsaozwpYF8+L3TMY/Iqrooa7uy/7HNOrTrqLZPSWImrFXbUKHhbvS8UqDrAxsvw9v0Gc/8k5Nar4tXsXTVweTGg0XApYik9wO8xJGmUnb9PMutT5B6QMt4UwQjoeJ/AMtkntDO2tijBfLjNLXR/2ArSMuskp2gkEV8dLEtJ6Pv+GIV5qSp9qYgbGTITpKU8Wx/JAbcwE9/oCyUSRwrkl8ZqlGEjpAkAo+FNnVF1qvAi2lWN3zulFg32wEVUEttUDClM8NZNZ02PSDgq+1PFT/WnwN58cfCao6s/W7nh+dr1dtSKxd3H6xAnN9H7mNiRB+IE2zZgouV8tLPS6FbMZVyafVMVwYO8xtmKV1rFl/psYR3V78Yox5v5+8o8Wj4RYE1p9IkAJdOF8TMZq0SBVCGnTd+anm3lq4nP
&nbsp; &nbsp; &nbsp; &nbsp; enc_part &nbsp; &nbsp; [3] :&nbsp;EncryptedData&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; etype &nbsp;[0] :&nbsp;0&nbsp;(UNKNOWN)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; kvno &nbsp;&nbsp;None&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cipher [2] : fYH8MIH5oIH2MIHzMIHwoCswKaADAgESoSIEIBensJXo6NKdyVioxhu4Wz/+IoSeJ2TMdyaiVg/fmP4XoRMbEUFUVEFDS1JBTkdFLkxPQ0FMohowGKADAgEBoREwDxsNU0EtTU9OSVRPUklOR6MHAwUAQOEAAKQRGA8yMDI2MDMxMzEyMzExOVqlERgPMjAyNjAzMTMxMjMxMTlaphEYDzIwMjYwMzEzMTIzMTE5WqcRGA8yMDI2MDMxMzEyMzExOVqoExsRQVRUQUNLUkFOR0UuTE9DQUypJjAkoAMCAQKhHTAbGwZrcmJ0Z3QbEUFUVEFDS1JBTkdFLkxPQ0FM**************************************************Saving&nbsp;KRB-CRED&nbsp;in&nbsp;example.kirbi

Microsoft-Windows-Security-Kerberos ETW 提供程序公开了事件 ID 202，该事件 ID 将监控权限不足时尝试导出会话密钥的行为。

kerasktgt Kerberos 请求票据授予票据

用于在 Kerberos 协议中请求第一个票据。如果未设置用户名，则 TGT 请求无需预先身份验证。它会将票据写入 KRB_CRED 格式，该格式与 Rubeus 或 Mimikatz 兼容。我们可以选择明文密码或 NTLM 哈希版本。

kerasktgs Kerberos 请求票据授予服务

用于通过已保存的 TGT 请求 TGS 工单。kerasktgs支持 S4U 协议扩展，可通过s4u选项进行设置。

Kerforce Kerberos 暴力破解

用于执行在线暴力破解攻击。文件属性就是一个文件，每行包含一个密码。

kerspray Kerberos 密码喷射

用于使用用户名列表执行 Kerberos 密码喷洒攻击。

kerticket Kerberos 票证查看器

打印保存在磁盘上的票据信息。用于将票据转换为 hashcat 兼容格式。我们可以EncTicketPartBody使用服务的哈希值或密码（包括 krbtgt）对其进行解密。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：TtTeam 《Rust 中使用 Kerberos》

Tags: 二进制安全安全工具渗透测试红队

你可能错过

格物致知：在RK3588 Linux平台上增加锂电池充电限制的实践之旅

Deepseek桌面版悄悄上线；Muse大火，扎克伯格跃升全球第四大富豪；OpenAI被曝筹备推出ProMax订阅层级，月费或达500-600美元 | 极客早知道

分库分表，可能真的要退出历史舞台了！

Sorry勒索软件新变种来袭