sqlmapproject/sqlmap · error · KerberosError

KerberosError(code, _expString(errorFields[11]) if 11 in…

Error message

KerberosError(code, _expString(errorFields[11]) if 11 in errorFields else None)

What it means

getTGT received a KRB-ERROR from the KDC and re-raises it as a KerberosError carrying the KDC's error code and (when present in field 11) its human-readable e-text. This is the normal path for KDC rejections such as KDC_ERR_PREAUTH_REQUIRED, PREAUTH_FAILED, CLIENT_NOT_FOUND, or clock-skew errors, so the original code matters more than the message.

Solutions

  1. Read the Kerberos error code: 24 (pre-auth required) is expected on the first probe and should drive the pre-auth retry, not be treated as fatal.
  2. 25/Pre-auth failed: wrong password or salt; fix credentials.
  3. 6/Client not found: verify principal spelling in the realm.
  4. 37/Clock skew: synchronize clocks with the KDC (NTP) or widen tolerance.
Defensive patterns

Strategy: try-catch

When it happens

Trigger: Thrown at extra/kerberos/client.py:351 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/4837ceb600866632. Report an issue: GitHub.

Appendix: source

Thrown at extra/kerberos/client.py:351

    # 1) probe without pre-auth to discover the etype/salt/iterations (or get the TGT outright)
    nonce = _nonce()
    response = _sendReceive(kdcHost, kdcPort, _asReq(realm, username, etypes, nonce))
    tag = der.peel(response)[0]

    if tag == der.applicationTag(AS_REP):                  # KDC issued the ticket without pre-auth
        etype = _replyEtype(response)                      # derive the key for the etype the KDC actually used
        rep = _fields(der.peel(der.peel(response)[1])[1])
        # the reply's own padata can still carry the salt/iterations of a non-default principal
        chosenSalt, iterations = _hintFor(_etypeHints(rep[2]) if 2 in rep else {}, etype, salt, chosenSalt)
        clientKey = _enctype(etype).string2key(password, chosenSalt, iterations)
        return _parseRep(response, clientKey, USAGE_AS_REP_ENCPART, nonce, AS_REP)

    etype, iterations = etypes[0], None
    if tag == der.applicationTag(KRB_ERROR):
        errorFields = _fields(der.peel(der.peel(response)[1])[1])
        code = _expInteger(errorFields[6]) if 6 in errorFields else -1
        if code != KDC_ERR_PREAUTH_REQUIRED:
            raise KerberosError(code, _expString(errorFields[11]) if 11 in errorFields else None)
        # the hint is unauthenticated, so it may only choose among the etypes we actually offered, and
        # in *our* order of preference rather than the KDC's (otherwise it could force a downgrade)
        hints = _preauthHints(errorFields)
        etype = _selectEtype(etypes, hints)
        chosenSalt, iterations = _hintFor(hints, etype, salt, chosenSalt)

    enc = _enctype(etype)
    clientKey = enc.string2key(password, chosenSalt, iterations)

    # 2) authenticated request with PA-ENC-TIMESTAMP under the discovered etype/salt
    patime, pausec = _timestamp()
    paTsEnc = der.sequence(der.tagged(0, der.generalizedTime(patime)), der.tagged(1, der.integer(pausec)))
    cipher = enc.encrypt(clientKey, USAGE_AS_REQ_PA_ENC_TIMESTAMP, paTsEnc)
    paData = der.sequence(
        der.tagged(1, der.integer(PA_ENC_TIMESTAMP)),
        der.tagged(2, der.octetString(_encryptedData(etype, cipher))),
    )
    nonce = _nonce()

View on GitHub (pinned to 0a35b20e39)