Skip to content
HackIndex logo

HackIndex

Kerberos realm and KDC discovery

5 min read May 18, 2026

Realm and KDC discovery is mostly DNS SRV + basic KDC reachability checks. The output becomes the targeting base for user enumeration, AS-REP roastable account discovery, and SPN enumeration.

DNS SRV discovery (authoritative source of KDCs)

Query both TCP and UDP SRV records. Kerberos supports both transports, and environments sometimes differ.

┌──(kali㉿kali)-[~]
└─$ dig +short SRV _kerberos._tcp.$DOMAIN
┌──(kali㉿kali)-[~]
└─$ dig +short SRV _kerberos._udp.$DOMAIN
Explain command
+short Display terse output, showing only the answer section.
SRV Query for SRV (Service Locator) DNS record type.
_kerberos._tcp.$DOMAIN SRV record name for Kerberos over TCP on the target domain.
_kerberos._udp.$DOMAIN SRV record name for Kerberos over UDP on the target domain.

If AD is in play, query the AD locator namespace for DCs and Kerberos. This often returns the actual DC hostnames even when _kerberos._tcp.$DOMAIN is sparse.

┌──(kali㉿kali)-[~]
└─$ dig +short SRV _kerberos._tcp.dc._msdcs.$DOMAIN
dig +short SRV _ldap._tcp.dc._msdcs.$DOMAIN
Explain command
+short Display terse output, showing only the answer section data.
SRV Query for SRV (Service Locator) DNS record type.
_kerberos._tcp.dc._msdcs.$DOMAIN SRV lookup target for Kerberos TCP service on AD domain controllers.
_ldap._tcp.dc._msdcs.$DOMAIN SRV lookup target for LDAP TCP service on AD domain controllers.
$DOMAIN Placeholder for the target Active Directory domain name.

What to expect:

  • Hostnames and ports (usually 88) plus priority/weight.

  • Multiple KDCs indicates multi-DC. Capture them all and test each; some are closer, some are filtered, some are read-only DCs.

What to do with results:

  • Resolve returned hostnames to IPs and treat each as a candidate DC/KDC target list.

  • If SRV returns nothing, either DNS is not authoritative/reachable from this vantage, or the realm isn’t $DOMAIN. Pivot to realm discover and general DNS enumeration.

Nmap SRV enumeration (one command for common AD services)

Nmap has dns-srv-enum which pulls a bundle of common SRV records including Kerberos KDC and kpasswd.

┌──(kali㉿kali)-[~]
└─$ nmap -p 53 --script dns-srv-enum --script-args "dns-srv-enum.domain=$DOMAIN" $TARGET_IP
Explain command
-p 53 Scan only port 53 (DNS service port).
--script dns-srv-enum Run NSE script to enumerate DNS SRV records.
--script-args "dns-srv-enum.domain=$DOMAIN" Pass target domain to the dns-srv-enum script for enumeration.
$TARGET_IP Placeholder for the target host's IP address.

Interpretation:

  • Useful when $TARGET_IP is a DNS server for $DOMAIN (often a DC).

  • If DNS is not on the target or recursion is blocked, run SRV queries directly against the domain’s DNS servers.

realmd discovery (KDC + realm config hints)

realm discover returns discovered realm configuration and is built for AD/IPA discovery.

┌──(kali㉿kali)-[~]
└─$ realm discover $DOMAIN
Explain command
$DOMAIN Target domain to query for Active Directory/Kerberos realm info.

What to capture:

  • Canonical realm name and server-software type (often active-directory when AD is detected).

  • Discovered controllers and recommended client config.

What to do with results:

  • If realm discover succeeds but DNS SRV didn’t, it’s a signal that discovery is happening through a different resolver path or SRV queries were blocked/pointed at the wrong DNS.

KDC reachability and fingerprinting (port 88)

Basic TCP service fingerprint:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 88 $TARGET_IP
Explain command
-sV Probe open ports to determine service/version info.
-p 88 Scan only port 88 (commonly used by Kerberos).
$TARGET_IP Placeholder for the target host IP address.

Kerberos commonly uses UDP 88 as well. Confirm UDP reachability explicitly:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 88 $TARGET_IP
Explain command
-sU Performs a UDP scan instead of the default TCP scan.
-p 88 Scans only port 88 (commonly used by Kerberos).
$TARGET_IP Placeholder for the target host IP address.

What to do with results:

  • If TCP 88 is open but UDP 88 is filtered, many Kerberos tools still work, but expect different behavior and more retries/timeouts.

  • If both are filtered, Kerberos-based enumeration won’t work from this network segment.

UDP “is it listening” probes (low confidence)

This is a weak signal only. UDP can drop silently even when a service is up, and netcat output isn’t a reliable indicator.

┌──(kali㉿kali)-[~]
└─$ echo "" | nc -u -w1 $TARGET_IP 88
Explain command
-u Use UDP instead of the default TCP protocol.
-w1 Set connection timeout to 1 second before closing.
$TARGET_IP Placeholder for the target host IP address.
88 Destination port number (Kerberos service port).

Use Nmap UDP results as the real decision input.

Time skew check (Kerberos blocker)

Large clock skew can break ticket workflows later. Check it early and fix local time before wasting cycles.

If ntpdate exists:

┌──(kali㉿kali)-[~]
└─$ ntpdate -q $TARGET_IP
Explain command
-q Query only; do not set the clock, just display time offset.
$TARGET_IP Target NTP server IP address to query.

Modern alternative:

┌──(kali㉿kali)-[~]
└─$ ntpdig $TARGET_IP

Interpretation:

  • Large offsets can cause ticket requests to fail with clock skew errors. Fix local time sync before Kerberos-heavy stages.

References