Add Kerberos AS-REQ user enumeration script

[n3rada]

For simplicity, I thought it should belong here instead of among the wild 'kerbrute'-like tools.

This script performs user enumeration via Kerberos AS-REQ, allowing checks for username existence in Active Directory without triggering account lockouts (incrementing of badPwdCount), making it interesting for initial reconnaissance.

Use the names.withletters trick to create name.a, name.b variants:

awk '/^[[:space:]]*$/ {next} { gsub(/^[ \t]+|[ \t]+$/,""); for(i=97;i<=122;i++) printf "%s.%c\n", $0, i }' /usr/share/seclists/Usernames/Names/names.txt | tee /tmp/names.txt > /dev/null

It was tested on Windows Server 2019/2022, on hercules.htb.

Single user check:

asreqUserCheck.py hercules.htb -u 'fernando.r`

Batch enumeration with threading:

asreqUserCheck.py hercules.htb -usersfile /tmp/names.txt --threads 30

The code is designed to be imported and used by other tools:

from impacket.examples.asreqUserCheck import kerberos_asreq_user_check

# Check a single user
result = kerberos_asreq_user_check("john.doe", "DOMAIN.LOCAL", "10.10.11.x")

# Returns structured dict:
# {
#     "username": "john.doe",
#     "exists": True,
#     "enabled": True,
#     "status": "valid",  # or "disabled", "invalid", "wrong_realm", "error"
#     "error": None,
#     "error_code": 25  # Kerberos error code
# }

if result["exists"] and result["enabled"]:
    print(f"[+] Valid user found: {result['username']}")

Could therefore be added in tool such as netexec.