mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

1.6 KiB

Raw Blame History

API Reference — Performing Kerberoasting Attack

Libraries Used

subprocess: Execute ldapsearch, PowerShell, Impacket GetUserSPNs, wevtutil
python-evtx: Parse Windows Security EVTX for Event ID 4769
xml.etree.ElementTree: Parse EVTX XML event data
impacket (external): GetUserSPNs.py for TGS ticket requests

CLI Interface

python agent.py enum --domain corp.example.com
python agent.py roast --domain corp.example.com [--user svc_account]
python agent.py analyze --file kerberoast_hashes.txt
python agent.py detect [--evtx security.evtx]

Core Functions

`enumerate_spn_accounts(domain)` — Find SPN-enabled accounts

LDAP query for (servicePrincipalName=*). Falls back to PowerShell Get-ADUser. Identifies high-value targets with admin group membership.

`request_tgs_tickets(domain, username)` — Execute Kerberoasting

Uses Impacket GetUserSPNs with -request flag. Outputs krb5tgs hashes.

`analyze_kerberoast_hashes(hash_file)` — Assess hash crackability

Categorizes by encryption type: RC4 (etype 23, crackable) vs AES (etype 17/18).

`detect_kerberoasting(evtx_file)` — Detect attack via Event ID 4769

Flags TGS requests with RC4 encryption (0x17) as suspicious Kerberoasting indicators.

Encryption Types

Etype	Algorithm	Crackability
0x17 (23)	RC4-HMAC	HIGH — fast offline cracking
0x11 (17)	AES128	LOW — computationally expensive
0x12 (18)	AES256	LOW — computationally expensive

Dependencies

pip install impacket python-evtx

System: ldapsearch (optional), PowerShell with AD module (Windows)

1.6 KiB Raw Blame History