Added: Option to adjust kerberos clock by rudraditya21 · Pull Request #20755 · rapid7/metasploit-framework

rudraditya21 · 2025-12-07T20:23:53Z

Closes #20587

Summary

Added KrbClockSkew advanced option and parser to offset Kerberos timestamps
Propagate skew through Kerberos client/authenticators (LDAP/SMB/HTTP/WinRM/MSSQL) and scanners
Updated docs for new option and extended kerberos client specs for clock skew handling
Clean up kerberos client error handling/style per rubocop

Testing

Start Postgres for tests (used Docker)

docker rm -f msf-postgres
docker run -d --name msf-postgres \
  -e POSTGRES_USER=msftest \
  -e POSTGRES_PASSWORD=changeme \
  -e POSTGRES_DB=msftest \
  -p 5433:5432 \
  postgres:15

Ensure config/database.yml test section matches:

test:
  adapter: postgresql
  host: 127.0.0.1
  port: 5433
  database: msftest
  username: msftest
  password: changeme
  pool: 5
  timeout: 5000

Migrate and run spec

DATABASE_URL=postgres://msftest:changeme@127.0.0.1:5433/msftest \
PGPASSWORD=changeme \
bundle _2.5.22_ exec rake db:create db:migrate RAILS_ENV=test

DATABASE_URL=postgres://msftest:changeme@127.0.0.1:5433/msftest \
PGPASSWORD=changeme \
bundle _2.5.22_ exec rspec spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb

Using KrbClockSkew in msfconsole

Select a Kerberos-enabled module (e.g., LDAP cert finder):

use auxiliary/gather/ldap_esc_vulnerable_cert_finder
set LDAP::Auth kerberos
set DomainControllerRhost 10.10.10.10
set LDAP::Rhostname dc01.test.corp
set DOMAIN test.corp
set KrbClockSkew -5m     # or 120s, 1h, etc.
show advanced            # to verify the option is set
run

- Added KrbClockSkew advanced option and parser to offset Kerberos timestamps - Propagate skew through Kerberos client/authenticators (LDAP/SMB/HTTP/WinRM/MSSQL) and scanners - Updated docs for new option and extended kerberos client specs for clock skew handling - Clean up kerberos client error handling/style per rubocop

jheysel-r7 · 2025-12-18T15:05:05Z

-      fail_with(Msf::Exploit::Failure::BadConfig, 'The HTTP::Rhostname option is required when using Kerberos authentication.') if datastore['HTTP::Rhostname'].blank?
-      fail_with(Msf::Exploit::Failure::BadConfig, 'The DOMAIN option is required when using Kerberos authentication.') if datastore['DOMAIN'].blank?
-      offered_etypes = Msf::Exploit::Remote::AuthOption.as_default_offered_etypes(datastore['HTTP::KrbOfferedEncryptionTypes'])
+      kerberos_authenticator = nil


Was this indentation intentional?

these indents were not intentional there would have been some mistakes while writing code i will fix this

jheysel-r7

Thanks for the great enhancement @rudraditya21, I can definitely see myself using this new feature.

One question, do you think it would be worth updating this error message:

metasploit-framework/lib/rex/proto/kerberos/model/error.rb

Line 173 in b40dbe8

    
           return "#{error_code}. Local time: #{now}, Server time: #{res.stime}, off by #{skew} seconds"

to let the operator know that they can set either set KrbClockSkew to fix the skew and or that the KrbClockSkew is not taken into account when calculating the skew printed in the error message?

I noticed in the testing below when setting KrbClockSkew = -24h, I was expecting a failure but the failure message was slightly confusing as it said the module failed due to a skew of 0 seconds. Let me know what you think. Other than that, everything looks great.

Testing

Spec

Run options:
  include {:focus=>true}
  exclude {:acceptance=>true}

All examples were filtered out; ignoring {:focus=>true}

Randomized with seed 1979
Msf::Exploit::Remote::Kerberos::Client .............

Top 10 slowest examples (0.14907 seconds, 25.2% of total time):
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt_pkinit when the authentication succeeds returns the ticket
    0.0702 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:480
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is required when the authentication fails returns the ticket
    0.01133 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:651
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is not required decrypts the ticket when the key is correct
    0.01077 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:565
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is required when the authentication succeeds returns the ticket
    0.0096 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:627
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when the account is unknown raises an erorr
    0.00933 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:515
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is not required decrypts the ticket when the password is correct
    0.00904 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:549
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is not required returns the ticket when the key is incorrect
    0.0088 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:600

Authenticated successfully with kerberos

msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
[*] Running module against 172.16.199.200
[+] 172.16.199.200:88 - Received a valid TGT-Response
[*] 172.16.199.200:389 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260106112347_default_172.16.199.200_mit.kerberos.cca_648171.bin
[+] 172.16.199.200:88 - Received a valid TGS-Response
[*] 172.16.199.200:389 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260106112347_default_172.16.199.200_mit.kerberos.cca_936292.bin
[+] 172.16.199.200:88 - Received a valid delegation TGS-Response
[+] 172.16.199.200:88 - Received AP-REQ. Extracting session key...
[*] Discovering base DN automatically
[*] user: Administrator, domain: kerberos.issue
[*] Detected target Windows version: 10.0.17763.5206
[+] Detected Windows Server 2019 version 10.0.17763.5206 — appears vulnerable (below Sept 2025 threshold 10.0.17763.7792). Module will continue.
[!] Could not find any details on the LDAP server for SID S-1-5-21-2324486357-3075865580-3606784161-1603!
^C[-] Stopping running against current target...
[*] Control-C again to force quit all targets.
[*] Auxiliary module execution completed

Authenticated unsuccessfully with kerberos due to clock skew set via the new datastore options

msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set KrbClockSkew -24h
KrbClockSkew => -24h
msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
[*] Running module against 172.16.199.200
[-] Auxiliary aborted due to failure: no-access: KRB_AP_ERR_SKEW (37) - Clock skew too great. Local time: 2026-01-06 11:24:00 -0800, Server time: 2026-01-06 19:24:00 UTC, off by 0 seconds
[*] Auxiliary module execution completed

rudraditya21 · 2026-01-07T11:02:35Z

Thanks for the great enhancement @rudraditya21, I can definitely see myself using this new feature.

One question, do you think it would be worth updating this error message:

metasploit-framework/lib/rex/proto/kerberos/model/error.rb

Line 173 in b40dbe8

    
           return "#{error_code}. Local time: #{now}, Server time: #{res.stime}, off by #{skew} seconds"

to let the operator know that they can set either set KrbClockSkew to fix the skew and or that the KrbClockSkew is not taken into account when calculating the skew printed in the error message?
I noticed in the testing below when setting KrbClockSkew = -24h, I was expecting a failure but the failure message was slightly confusing as it said the module failed due to a skew of 0 seconds. Let me know what you think. Other than that, everything looks great.

Testing

Spec

Run options:
  include {:focus=>true}
  exclude {:acceptance=>true}

All examples were filtered out; ignoring {:focus=>true}

Randomized with seed 1979
Msf::Exploit::Remote::Kerberos::Client .............

Top 10 slowest examples (0.14907 seconds, 25.2% of total time):
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt_pkinit when the authentication succeeds returns the ticket
    0.0702 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:480
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is required when the authentication fails returns the ticket
    0.01133 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:651
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is not required decrypts the ticket when the key is correct
    0.01077 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:565
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is required when the authentication succeeds returns the ticket
    0.0096 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:627
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when the account is unknown raises an erorr
    0.00933 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:515
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is not required decrypts the ticket when the password is correct
    0.00904 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:549
  Msf::Exploit::Remote::Kerberos::Client#send_request_tgt when kerberos preauth is not required returns the ticket when the key is incorrect
    0.0088 seconds ./spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb:600

Authenticated successfully with kerberos

msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
[*] Running module against 172.16.199.200
[+] 172.16.199.200:88 - Received a valid TGT-Response
[*] 172.16.199.200:389 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260106112347_default_172.16.199.200_mit.kerberos.cca_648171.bin
[+] 172.16.199.200:88 - Received a valid TGS-Response
[*] 172.16.199.200:389 - TGS MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260106112347_default_172.16.199.200_mit.kerberos.cca_936292.bin
[+] 172.16.199.200:88 - Received a valid delegation TGS-Response
[+] 172.16.199.200:88 - Received AP-REQ. Extracting session key...
[*] Discovering base DN automatically
[*] user: Administrator, domain: kerberos.issue
[*] Detected target Windows version: 10.0.17763.5206
[+] Detected Windows Server 2019 version 10.0.17763.5206 — appears vulnerable (below Sept 2025 threshold 10.0.17763.7792). Module will continue.
[!] Could not find any details on the LDAP server for SID S-1-5-21-2324486357-3075865580-3606784161-1603!
^C[-] Stopping running against current target...
[*] Control-C again to force quit all targets.
[*] Auxiliary module execution completed

Authenticated unsuccessfully with kerberos due to clock skew set via the new datastore options

msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set KrbClockSkew -24h
KrbClockSkew => -24h
msf auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run
[*] Running module against 172.16.199.200
[-] Auxiliary aborted due to failure: no-access: KRB_AP_ERR_SKEW (37) - Clock skew too great. Local time: 2026-01-06 11:24:00 -0800, Server time: 2026-01-06 19:24:00 UTC, off by 0 seconds
[*] Auxiliary module execution completed

Yes, this is a good idea. Improving the error messages would help improve clarity. Do you have any suggestions for crafting better error messages?

jheysel-r7 · 2026-01-07T15:46:31Z

@rudraditya21 I think updating it to say the following would suffice:

return "#{error_code}. Local time: #{now}, Server time: #{res.stime}, off by #{skew} seconds. Note the advanced datastore option 'KrbClockSkew' can be set in order to rectify this skew."

jheysel-r7 · 2026-01-19T18:04:10Z

Release Notes

This adds an advanced datastore option, KrbClockSkew, to modules that use Kerberos authentication, allowing operators to adjust the Kerberos clock from the Metasploit side to fix clock skew errors.

rudraditya21 changed the title ~~Added: Option to adjust kerberos clock (issue-> #20587)~~ Added: Option to adjust kerberos clock Dec 7, 2025

smcintyre-r7 added library enhancement labels Dec 8, 2025

jheysel-r7 reviewed Dec 18, 2025

View reviewed changes

smcintyre-r7 mentioned this pull request Dec 18, 2025

Add OptTimedelta datastore option #20790

Closed

rudraditya21 added 2 commits December 28, 2025 23:16

Merge branch 'rapid7:master' into feature/kerberos-clock-skew

8342493

fixed: merge conflict

4fbc647

jheysel-r7 self-assigned this Jan 6, 2026

jheysel-r7 added this to Metasploit Kanban Jan 6, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Jan 6, 2026

jheysel-r7 added the rn-enhancement release notes enhancement label Jan 6, 2026

jheysel-r7 reviewed Jan 6, 2026

View reviewed changes

jheysel-r7 moved this from Todo to Waiting on Contributor in Metasploit Kanban Jan 7, 2026

updated: error message

166c8b7

jheysel-r7 approved these changes Jan 14, 2026

View reviewed changes

github-project-automation Bot moved this from Waiting on Contributor to In Progress in Metasploit Kanban Jan 14, 2026

jheysel-r7 merged commit eb49dad into rapid7:master Jan 19, 2026
46 of 58 checks passed

github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban Jan 19, 2026

cdelafuente-r7 mentioned this pull request Jan 20, 2026

Fix specs issue due to a missing KrbClockSkew option #20887

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added: Option to adjust kerberos clock #20755

Added: Option to adjust kerberos clock #20755
jheysel-r7 merged 4 commits intorapid7:masterfrom
rudraditya21:feature/kerberos-clock-skew

rudraditya21 commented Dec 7, 2025 •

edited by adfoster-r7

Loading

Uh oh!

jheysel-r7 Dec 18, 2025

Uh oh!

rudraditya21 Dec 22, 2025 •

edited

Loading

Uh oh!

Uh oh!

jheysel-r7 left a comment •

edited

Loading

Uh oh!

rudraditya21 commented Jan 7, 2026

Testing

Uh oh!

jheysel-r7 commented Jan 7, 2026

Uh oh!

Uh oh!

jheysel-r7 commented Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

rudraditya21 commented Dec 7, 2025 • edited by adfoster-r7 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jheysel-r7 Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

rudraditya21 Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jheysel-r7 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Testing

Uh oh!

rudraditya21 commented Jan 7, 2026

Testing

Uh oh!

jheysel-r7 commented Jan 7, 2026

Uh oh!

Uh oh!

jheysel-r7 commented Jan 19, 2026

Release Notes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rudraditya21 commented Dec 7, 2025 •

edited by adfoster-r7

Loading

rudraditya21 Dec 22, 2025 •

edited

Loading

jheysel-r7 left a comment •

edited

Loading