Skip to content

Add Kerberos ticket trace verbosity levels#21568

Open
eve0805 wants to merge 1 commit into
rapid7:masterfrom
eve0805:feature/kerberos-ticket-trace-level
Open

Add Kerberos ticket trace verbosity levels#21568
eve0805 wants to merge 1 commit into
rapid7:masterfrom
eve0805:feature/kerberos-ticket-trace-level

Conversation

@eve0805

@eve0805 eve0805 commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Overview

This PR builds on #21466 by adding a KerberosTicketTraceLevel option for Kerberos ticket tracing.

The new option controls how much Kerberos trace detail is printed when KerberosTicketTrace is enabled.

Trace Levels

KerberosTicketTraceLevel supports three modes:

  • meta: prints high-level metadata and avoids expanding binary ticket or encrypted payload contents
  • ticket: prints ticket-oriented trace output while still redacting raw binary payload contents
  • full: preserves the existing verbose behavior and expands binary fields as hex

The default value is full, so existing KerberosTicketTrace behavior remains unchanged unless users explicitly choose a lower verbosity level.

Changes

  • Adds KerberosTicketTraceLevel as an OptEnum with meta, ticket, and full
  • Registers the option in both Kerberos client and service authenticator option paths
  • Updates the Kerberos logger subscriber to select formatting behavior based on the trace level
  • Adds metadata-only credential rendering for meta
  • Redacts binary field contents for non-full trace levels
  • Updates readable text option specs and Kerberos logger subscriber specs

Testing

  • bundle exec rspec spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb
  • bundle exec rspec spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
  • bundle exec rspec spec/lib/msf/base/serializer/readable_text_spec.rb
  • bundle exec rubocop lib/msf/core/exploit/remote/kerberos/client.rb lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb lib/rex/proto/kerberos/kerberos_logger_subscriber.rb spec/lib/msf/base/serializer/readable_text_spec.rb spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb

@github-actions

Copy link
Copy Markdown

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

3 participants