Impacket describeTicket.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Reads tickets in ccache or kirbi format and, when a key is available, decrypts and displays the encrypted parts and PAC.
| Item | Details |
|---|---|
| Implementation | examples/describeTicket.py |
| Category | Kerberos / Ticket Handling |
| Size | 771 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/describeTicket.py -h for the current option definitions.
| Argument | Description |
|---|---|
ticket | Path to ticket.ccache. |
-debug | Enable debug logging. |
-ts | Add timestamps to log output. |
-p / --password | Plaintext password of the service account. |
-hp / --hex-password | Hex-encoded password of the service account. |
-u / --user | Service account name. |
-d / --domain | Fully qualified domain name. |
-s / --salt | Salt for key derivation (DOMAIN.LOCALSomeuser for users; DOMAIN.LOCALhostsomemachine.domain.local for machines). |
--rc4 | RC4 key (for example, an NT hash). |
--aes | AES-128 or AES-256 key. |
--asrep-key | AS reply key for decrypting PAC credentials. |
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command detects the input format, reads the ticket and metadata, and derives candidate keys from a password, hex password, RC4/AES key, or AS-REP key. After decrypting the ticket’s encrypted part, it parses PAC buffers by type and displays SIDs, groups, flags, checksums, and times. It can also produce Kerberoast output from a ccache.
How It Works
Section titled “How It Works”A ticket file contains an encrypted ticket and the session key and principal metadata needed to use it. For a ccache, the command reads the ticket, client and server principals, and session key from credential entries. For kirbi/KRB-CRED, it decodes the enc-part and normalizes the equivalent information. Detecting the container format is the first parsing stage.
Reading the ticket’s enc-part requires the service principal’s long-term key.
The command can derive keys from a password with the domain/user salt,
accept RC4 or AES keys directly, or use an AS-REP key. It tries only candidate
keys matching the ticket’s enctype and key usage. A checksum failure means
the key, salt, or principal information does not match; it is not a parsing failure.
After decryption, the command displays EncTicketPart flags, times, and
authorization data. If a PAC is present, it traverses the buffer directory
to expand group memberships, SIDs, UPN/DNS data, client and device claims,
device information, checksums, and more. It parses uncompressed claims
and reports that unsupported compressed formats cannot be decoded. It
converts PAC FILETIME values, NDR pointers, and flags for display while keeping raw values traceable for investigating unknown extensions.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
User_Flags | 46 | Structure and constant definitions |
SE_GROUP_Attributes | 51 | Structure and constant definitions |
USER_ACCOUNT_Codes | 57 | Structure and constant definitions |
UF_FLAG_Codes | 82 | Structure and constant definitions |
Upn_Dns_Flags | 109 | Structure and constant definitions |
Attributes_Flags | 114 | Structure and constant definitions |
parse_ccache() | 220 | Module function |
parse_pac() | 355 | Module function |
kerberoast_from_ccache() | 670 | Module function |
parse_args() | 713 | Module function |
main() | 758 | Module function |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket | version |
impacket.dcerpc.v5.dtypes | FILETIME, PRPC_SID |
impacket.dcerpc.v5.rpcrt | TypeSerialization1 |
impacket.examples | logger |
impacket.krb5 | constants, pac |
impacket.krb5.asn1 | AD_IF_RELEVANT, EncTicketPart, TGS_REP |
impacket.krb5.ccache | CCache |
impacket.krb5.constants | ChecksumTypes |
impacket.krb5.crypto | InvalidChecksum, Key, _enctype_table, generate_kerberos_keys |
impacket.ldap.ldaptypes | LDAP_SID |
External Packages (Direct Use)
Section titled “External Packages (Direct Use)”| Import Name | Distribution Package | Usage / Declaration Status |
|---|---|---|
Cryptodome | pycryptodomex | Imported directly; declared dependency |
pyasn1 | pyasn1 | Imported directly; declared dependency |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- The main operation parses a local file. Treat input as untrusted: validate offsets, lengths, and format identifiers before accessing data.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
When Changing the Implementation
Section titled “When Changing the Implementation”This command depends on krb5.ccache / asn1 / crypto / pac, pyasn1, Cryptodome.Hash.MD4, and the LDAP SID helper. parse_ccache() and parse_pac() are the format boundaries.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/describeTicket.py - CLI:
python examples/describeTicket.py -h - Related test:
tests/SMB_RPC/test_rpcrt.py - Related test:
tests/misc/test_ccache.py - Related test:
tests/misc/test_crypto.py - Related test:
tests/misc/test_krb5_crypto.py - Related test:
tests/misc/test_krb5_gssapi.py