mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
44 lines
1.6 KiB
Markdown
44 lines
1.6 KiB
Markdown
# API Reference — Performing Kerberoasting Attack
|
|
|
|
## Libraries Used
|
|
- **subprocess**: Execute ldapsearch, PowerShell, Impacket GetUserSPNs, wevtutil
|
|
- **python-evtx**: Parse Windows Security EVTX for Event ID 4769
|
|
- **xml.etree.ElementTree**: Parse EVTX XML event data
|
|
- **impacket** (external): GetUserSPNs.py for TGS ticket requests
|
|
|
|
## CLI Interface
|
|
```
|
|
python agent.py enum --domain corp.example.com
|
|
python agent.py roast --domain corp.example.com [--user svc_account]
|
|
python agent.py analyze --file kerberoast_hashes.txt
|
|
python agent.py detect [--evtx security.evtx]
|
|
```
|
|
|
|
## Core Functions
|
|
|
|
### `enumerate_spn_accounts(domain)` — Find SPN-enabled accounts
|
|
LDAP query for `(servicePrincipalName=*)`. Falls back to PowerShell Get-ADUser.
|
|
Identifies high-value targets with admin group membership.
|
|
|
|
### `request_tgs_tickets(domain, username)` — Execute Kerberoasting
|
|
Uses Impacket GetUserSPNs with `-request` flag. Outputs $krb5tgs$ hashes.
|
|
|
|
### `analyze_kerberoast_hashes(hash_file)` — Assess hash crackability
|
|
Categorizes by encryption type: RC4 (etype 23, crackable) vs AES (etype 17/18).
|
|
|
|
### `detect_kerberoasting(evtx_file)` — Detect attack via Event ID 4769
|
|
Flags TGS requests with RC4 encryption (0x17) as suspicious Kerberoasting indicators.
|
|
|
|
## Encryption Types
|
|
| Etype | Algorithm | Crackability |
|
|
|-------|-----------|-------------|
|
|
| 0x17 (23) | RC4-HMAC | HIGH — fast offline cracking |
|
|
| 0x11 (17) | AES128 | LOW — computationally expensive |
|
|
| 0x12 (18) | AES256 | LOW — computationally expensive |
|
|
|
|
## Dependencies
|
|
```
|
|
pip install impacket python-evtx
|
|
```
|
|
System: ldapsearch (optional), PowerShell with AD module (Windows)
|