Re: Kerberos probes for nmap

[David Fifield <david () bamsoftware com>]

On Tue, Dec 22, 2009 at 08:40:13AM +0100, Patrik Karlsson wrote:
> Heimdal now returns an error "No client in request" while Windows is
> saying KDC_ERR_WRONG_REALM.
>
> When building my KrbGuess tool, that guesses valid usernames against a
> Kerberos server, I had to look into the details of the Kerberos
> protocol. I wrote some code that builds Kerberos packets, that
> unfortunately doesn't handle removing the stuff I have done now. So I
> have done it all by hand too. 

I've committed the new probe. Good job! I think we have a solid probe
and match lines now. It's even possible to extract the server's clock
setting from the error reply.

It's a pity we can't use the probe that makes Windows disclose the
realm. Out of curiosity, what were the contents of the reply? Maybe it
can be made into an NSE script.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/