Skip to content

Add Kerberos ticket trace verbosity levels#21568

Closed
eve0805 wants to merge 1 commit into
rapid7:masterfrom
eve0805:feature/kerberos-ticket-trace-level
Closed

Add Kerberos ticket trace verbosity levels#21568
eve0805 wants to merge 1 commit into
rapid7:masterfrom
eve0805:feature/kerberos-ticket-trace-level

Conversation

@eve0805

@eve0805 eve0805 commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Overview

This PR builds on #21466 by adding a KerberosTicketTraceLevel option for Kerberos ticket tracing.

The new option controls how much Kerberos trace detail is printed when KerberosTicketTrace is enabled.

Trace Levels

KerberosTicketTraceLevel supports three modes:

  • meta: prints high-level metadata and avoids expanding binary ticket or encrypted payload contents
  • ticket: prints ticket-oriented trace output while still redacting raw binary payload contents
  • full: preserves the existing verbose behavior and expands binary fields as hex

The default value is full, so existing KerberosTicketTrace behavior remains unchanged unless users explicitly choose a lower verbosity level.

Changes

  • Adds KerberosTicketTraceLevel as an OptEnum with meta, ticket, and full
  • Registers the option in both Kerberos client and service authenticator option paths
  • Updates the Kerberos logger subscriber to select formatting behavior based on the trace level
  • Adds metadata-only credential rendering for meta
  • Redacts binary field contents for non-full trace levels
  • Updates readable text option specs and Kerberos logger subscriber specs

Testing

  • bundle exec rspec spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb
  • bundle exec rspec spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb
  • bundle exec rspec spec/lib/msf/base/serializer/readable_text_spec.rb
  • bundle exec rubocop lib/msf/core/exploit/remote/kerberos/client.rb lib/msf/core/exploit/remote/kerberos/service_authenticator/options.rb lib/rex/proto/kerberos/kerberos_logger_subscriber.rb spec/lib/msf/base/serializer/readable_text_spec.rb spec/lib/msf/core/exploit/remote/kerberos/client_spec.rb spec/lib/rex/proto/kerberos/kerberos_logger_subscriber_spec.rb

@github-actions

Copy link
Copy Markdown

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.

@jheysel-r7 jheysel-r7 self-assigned this Jun 25, 2026
@jheysel-r7 jheysel-r7 added GSoC Google Summer of Code project PRs enhancement rn-enhancement release notes enhancement labels Jun 25, 2026
@eve0805

eve0805 commented Jul 2, 2026

Copy link
Copy Markdown
Contributor Author

Closing this PR in favor of #21637, which supersedes this implementation by changing KerberosTicketTrace from a boolean plus KerberosTicketTraceLevel into a single enum option with off/metadata/ticket/full modes. Thanks!

@eve0805 eve0805 closed this Jul 2, 2026
@github-project-automation github-project-automation Bot moved this from Todo to Done in Metasploit Kanban Jul 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

additional-testing-required enhancement GSoC Google Summer of Code project PRs rn-enhancement release notes enhancement

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

4 participants