KerberosTicketTrace: Add centralized Kerberos tracing with metadata/full modes + module integration

[Pushpenderrathore]

Summary

This PR introduces a centralized Kerberos tracing mechanism for the Metasploit Framework, allowing operators to inspect Kerberos ticket metadata inline during module execution.

The implementation follows the existing HttpTrace design pattern and introduces two verbosity levels:

• metadata → principal, realm, encryption type
• full → includes timestamps and flags (when decrypted)

This improves visibility into Kerberos authentication flows without requiring external tools.

---

What This Change Does

• Adds a new trace class:

  • lib/msf/core/trace/kerberos_ticket_trace.rb

• Adds centralized dispatcher in Kerberos client:

  • kerberos_trace_enabled?
  • kerberos_trace()

• Registers new advanced option:

  • KerberosTrace (off, metadata, full)

• Integrates tracing into:

  • PKINIT flow
  • AS-REP (no pre-auth) flow
  • Pre-authentication flow

• Adds module-level integration:

  • auxiliary/gather/kerberos_enumusers
  • auxiliary/scanner/kerberos/kerberos_login

• Ensures:

  • Nil-safe handling across all ticket types
  • No sensitive data exposure (no keys or PAC data logged)

---

Verification

Steps to verify the feature works correctly:

• Start msfconsole
• use auxiliary/gather/kerberos_enumusers
• set RHOSTS <target-ip>
• set DOMAIN <domain>
• set USER_FILE users.txt
• set PASSWORD test
• set KerberosTrace metadata
• run
• Verify output shows:
  [KerberosTrace] ----------------------------------------- Principal : DOMAIN / username Enc Type : <etype>
• Set KerberosTrace full
• run
• Verify timestamps and flags are printed when available
• Verify no crashes occur when decrypted_part is nil
• Verify no sensitive data (keys, PAC) is printed

---

Testing

• IRB validation completed

• Basic RSpec test added for KerberosTicketTrace

• Verified across:

  • PKINIT
  • AS-REP
  • Pre-auth flows

---

Notes

• This PR is intentionally scoped to Kerberos tracing only for easier review.
• CertificateTrace (X.509 / CSR tracing) will be submitted as a follow-up PR.

---

Motivation

Modern Active Directory environments heavily rely on Kerberos authentication. Providing inline visibility into ticket metadata improves debugging, reduces reliance on external tooling, and aligns with Metasploit’s goal of maintaining a seamless exploitation workflow.

[github-actions]

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.

[Pushpenderrathore]

The flagged content was part of an accidentally committed archive file (project_dump.zip), which has now been removed from the repository history. No secrets are present in the current codebase.

[Pushpenderrathore]

This PR introduces a centralized Kerberos tracing system with metadata and full verbosity modes.
The implementation is intentionally scoped to Kerberos only to keep review focused and incremental.

Certificate tracing will be submitted as a follow-up PR.