Kerberos-trace

[eve0805]

Overview

This PR introduces KerberosTicketTrace support for Metasploit's Kerberos authentication flows.

The goal is to improve visibility into Kerberos ticket acquisition and service-authentication behavior directly during module execution. The implementation uses a Rex-layer subscriber/logger design.

Perspective

Kerberos authentication is widely used in Active Directory and enterprise environments. When Kerberos authentication fails, it can be difficult to tell whether the issue comes from pre-authentication, encryption type negotiation, ticket selection, service principal selection, delegation behavior, AP exchange handling, or the protocol wrapper carrying the Kerberos blob.

This PR adds operator-readable Kerberos trace output for AS/TGS/AP-related paths while keeping tracing opt-in and disabled by default.

Features Implemented

• Adds KerberosTicketTrace as an opt-in Boolean trace option

• Adds KerberosTicketTraceColors for request/response trace coloring

• Registers Kerberos trace options through the shared kerberos_auth_options helper

• Traces core Kerberos request and response messages:

  AS-REQ、AS-REP、TGS-REQ、TGS-REP、KRB-ERROR

• Uses the Rex Kerberos client subscriber path for request/response tracing

• Adds readable Kerberos trace output through a logger subscriber and presenter

• Handles credential trace output for TGT, TGS, and delegation-related credential paths

Technical Implementation

• Adds Kerberos trace subscription through the Rex Kerberos client layer
• Adds logger/presenter logic for readable Kerberos trace output
• Reuses shared Kerberos option registration through kerberos_auth_options
• Integrates trace output with existing Metasploit module logging behavior
• Keeps tracing disabled unless KerberosTicketTrace is enabled
• Avoids requiring separate Kerberos trace implementations for HTTP, SMB, LDAP, MSSQL, and WinRM at this stage

Testing & Validation

• Added/updated specs for the Kerberos logger subscriber
• Tested disabled tracing behavior
• Tested request and response trace rendering
• Tested credential trace rendering
• Tested color configuration behavior

Example Usage

Enable Kerberos ticket tracing in a Kerberos-enabled module:

set KerberosTicketTrace true

Optionally configure trace colors:

set KerberosTicketTraceColors red/blu

Impact

• Improves debugging of Kerberos authentication failures
• Makes Kerberos ticket exchanges easier to inspect during normal module execution
• Helps developers and operators understand AS/TGS/AP-related behavior without external tooling
• Provides a shared tracing foundation for future Kerberos trace levels, semantic events, AP/GSS/SPNEGO tracing, delegation tracing, offline artifact inspection, and forged-ticket workflows

Future Work

• Add KerberosTicketTraceLevel with levels such as meta, ticket, and full
• Add structured semantic Kerberos workflow events
• Extend AP exchange and GSS/SPNEGO encapsulation tracing
• Add explicit S4U2Self/S4U2Proxy delegation context tracing
• Reuse the same output conventions for offline ticket inspection paths
• Extend tracing to forged-ticket workflows
• Add documentation for trace usage and output interpretation

Notes on Usage

The new advanced options can be viewed from a Kerberos-enabled module:

./msfconsole
use auxiliary/admin/kerberos/get_ticket
show advanced

References

• Related prior PR: Kerberos-trace rapid7/metasploit-framework#21190
• GSoC project idea: CertificateTrace and KerberosTicketTrace Support

[github-actions]

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.