Expired passwords are treated as failures about kerbrute HOT 3 CLOSED

Thanks for reporting - interesting case I hadn't considered.

It's definitely an error I can handle better - but I don't think it's as simple as treating it as a success either. From what I can tell, if the user's password is expired - ANY password will result in this KDC error. If we treated it as a success you'd get a lot of "false positives" thinking you got a valid login when you really don't.

One thing that may be possible is when that error is encountered is to attempt a password reset with the current password guess. I don't want this tool to actually change or reset any passwords, so I'll have to see if there's a way to "test" it and then abort before a reset actually happens.

from kerbrute.

Okay nevermind - it does only give that error if the password is correct. I was testing against a user who had pre-auth disabled (another edge case to deal with). I'll cut a new branch to handle both cases

from kerbrute.

Fixed in #12

I'll cut a new release shortly with this fix. Thanks!

from kerbrute.