Python 3 Linux utility that uses ARP cache poisoning on a local network segment to observe Kerberos AS-REQ/AS-REP exchanges. Relay mode intercepts Kerberos TCP/88 client requests and relays them to the domain controller; it can force RC4 only when the client advertises it and the domain controller supports it. Listen mode poisons the ARP entry for the selected AS-REP source and observes replies without changing them in transit. It writes captured Kerberos material in hashcat or John format and can record usernames seen in TGS-REP responses. Capture depends on client Kerberos activity and network/domain-controller conditions; it does not dump NTLM hashes.
Python
RESTRICTED_ACCESS_BLUR_MARKER