How exactly the netexec krb5 conf cache working

[rudSarkar]

Hello,

I am trying to figure out a cache issue of netexec that occurred when I used the --generate-krb5-file command to generate the krb5 conf

nxc smb 10.10.12.76 -u '<username>' -p '<password>' --generate-krb5-file krb5.conf -k

Everything was okay, but when I tried to invalidate the krb5 conf mapping. I tried deleting the netexec DB file ( the whole ~/.nxc folder ), kdestroy -A, and unset the KRB5CCNAME, but netexec was holding the krb5 mapping, which is weird. I tried everything, then I used crackmapexec, and I saw that the mapping was not working, then I realized it might be the issue of netexec.

So, if some one please help me to understand this it will be helpful about this cache issue and how does it even working on netexec.

Thanks

[Marshall-Hallenbeck]

Did you move the krb5.conf to /etc/krb5.conf? Just generating it doesn't actually set it.

[Marshall-Hallenbeck]

Also, AFAIK a SKEW error will happen before any other sort of issue because the two systems won't be able to setup the initial Kerberos handshake to even check auth.

[rudSarkar]

I gotta check this from a Linux machine, I think there are some problems with macOS. Thanks for your time. I really appreciate. I will update here.

[Marshall-Hallenbeck]

NP! I can't really help with MacOS since I don't own one and haven't used one in like 10 years. I would recommend just running stuff on a Linux VM because OSx, while Unix based, does a lot of weird shit.

[rudSarkar]

Totally agree with you.

[rudSarkar]

So, I figured that it's a problem of macOS; actually, it was working fine on the Linux machine, automatically mapping the REALM. Closing this discussion, thanks again.