g0h4n/RustHound-CE

Summary Add Kerberos (pass-the-ticket) authentication to the SMB transport in transport/smb.rs, so the sessions module (SRVSVC / WKSSVC / WINREG over IPC$) and GPO SYSVOL collection can authenticate with a Kerberos ticket, in addition to the existing password and pass-the-hash paths. Motivation transport::smb currently supports two SESSION_SETUP paths via SmbAuth: SmbAuth::Password (NTLMv2) SmbAuth::Hash (pass-the-hash) The LDAP side of RustHound-CE already speaks Kerberos (GSSAPI), so an operator running with a TGT/ccache can collect over LDAP but then falls back to NTLM/PtH for the SMB/RPC paths. This is inconsistent, and NTLM is increasingly disabled in hardened environments. A Kerberos path would let the whole collection run under one authentication mechanism and work where NTLM is turned off. Proposed change smb2-client already exposes SmbClient::login_kerberos(gss_blob, session_key), which performs the SESSION_SETUP from a prebuilt SPNEGO AP-REQ and its 16-byte GSS session key.

Feature description It would be very useful to add support for certificate-based authentication using a PFX file in RustHound-CE, leveraging a Pass-the-Certificate technique via Schannel. This feature would allow operators to authenticate to Active Directory using an exported certificate (PFX) without requiring a password, NT hash, or Kerberos ticket, similarly to existing techniques like Pass-the-Hash or Pass-the-Ticket. Motivation / Use case Certificate-based authentication is increasingly common in modern Active Directory environments (AD CS, smartcard logon, machine certs, etc.) and is often overlooked by traditional detection. Expected behavior Ability to authenticate using a PFX certificate + private key Authentication performed via Schannel No password, NTLM hash, or Kerberos ticket required Compatible with existing RustHound-CE enumeration logic once authenticated Example: # from .pfx rusthound-ce \ --domain essos.local \ --pfx user.pfx \ --pfx-pass "<Optionnal>