Kerberos / Ticket Handling

Back to the Command Index

This category covers AS/TGS exchanges with the KDC (TCP 88), PAC, ccache/kirbi, S4U, and ticket forgery. Most shared code is in impacket.krb5, but S4U2self / S4U2proxy / U2U are mainly in examples/getST.py rather than getKerberosTGS.

Kerberos — etype, key usage, PAC, S4U, ccache
LDAP and AD Security Descriptors — finding roasting targets
NTLM / SPNEGO — the relationship between NT hashes and RC4 long-term keys

Command Index

Command	Summary
GetNPUsers.py	Finds accounts that do not require preauthentication through LDAP. Optionally obtains AS-REPs and saves them in a format for offline analysis.
GetUserSPNs.py	Enumerates user account SPNs from LDAP. Optionally obtains TGSs and outputs them in a format for offline analysis.
getPac.py	Obtains a target user’s PAC through S4U2self and U2U exchanges, and displays each buffer.
getST.py	Obtains TGSs, performs S4U2self/S4U2proxy and U2U, renews tickets, and saves the resulting service tickets to ccache.
getTGT.py	Requests a TGT using a password, NT hash, AES key, or keytab, and saves it to ccache.
goldenPac.py	Creates a ticket with a modified PAC for testing MS14-068. Can use the resulting privileges for execution over SMB or save the ticket.
keylistattack.py	Uses an RODC number and key to send a Kerberos Key List request for the long-term keys of specified or enumerated accounts.
kintercept.py	Relays Kerberos TCP traffic and observes or transforms requests and responses as a development proxy.
raiseChild.py	Tests a privilege escalation path from a child domain to the forest root. Retrieves credentials through DRS and creates a ticket containing SIDHistory.
describeTicket.py	Reads tickets in ccache or kirbi format and, if keys are available, decrypts and displays encrypted portions and the PAC.
ticketConverter.py	Converts between MIT/Heimdal ccache and Windows KRB-CRED (kirbi), with support for Base64 input and output.
ticketer.py	Creates Golden/Silver Tickets from SIDs, groups, and keys, or modifies an existing ticket and PAC and saves it to ccache.