Impacket getPac.py

Back to the Category Index / Back to the Command Index

Overview

Uses S4U2self and U2U exchanges to obtain a target user’s PAC and display the contents of each buffer.

Item	Details
Implementation	examples/getPac.py
Category	Kerberos / Ticket Handling
Size	321 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/getPac.py -h for the current option definitions.

Argument	Description
credentials	domain/username[:password]; valid domain credentials for retrieving the target user’s PAC.
-targetUser	User whose PAC will be retrieved (required).
-debug	Enable debug logging.
-ts	Add timestamps to log output.
-hashes	NTLM hashes in LMHASH:NTHASH format.

Detailed Processing Flow

The command obtains a TGT with the supplied credentials and builds a TGS request containing PA-FOR-USER for the target user. It decrypts the returned ticket’s encrypted part, extracts PACTYPE from authorization data, and parses logon information, client information, signatures, and UPN/DNS information by buffer type.

How It Works

The PAC is stored in a ticket’s authorization data, usually inside the EncTicketPart encrypted with the service key. This command combines S4U2self and user-to-user so the KDC issues a ticket that the caller can decrypt to inspect its PAC.

It first obtains the service account’s TGT, then builds an S4U2self TGS-REQ containing a PA-FOR-USER checksum. In U2U, it includes an additional ticket in the request so the KDC can return a service ticket protected with the session key. It decrypts the response with the correct key usage and extracts AD-IF-RELEVANT, then PACTYPE, from EncTicketPart.authorization-data.

The PAC consists of a buffer directory and variable-length payloads. printPac() dispatches logon information, client information, server/KDC checksums, and UPN/DNS information to NDR structures by type. The parser must skip unknown buffers, keep offsets and sizes within the ticket, and avoid treating signature values as ordinary data.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
S4U2SELF	53	__init__(), printPac(), dump()

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.dcerpc.v5.rpcrt	TypeSerialization1
impacket.examples	logger
impacket.examples.utils	parse_identity
impacket.krb5	constants
impacket.krb5.asn1	AD_IF_RELEVANT, AP_REQ, AS_REP, Authenticator, EncTicketPart, PA_FOR_USER_ENC, TGS_REP, TGS_REQ, Ticket, seq_set, seq_set_iter
impacket.krb5.crypto	Enctype, Key, _HMACMD5, _enctype_table
impacket.krb5.kerberosv5	getKerberosTGT, sendReceive
impacket.krb5.pac	KERB_VALIDATION_INFO, PACTYPE, PAC_CLIENT_INFO, PAC_CLIENT_INFO_TYPE, PAC_INFO_BUFFER, PAC_PRIVSVR_CHECKSUM, PAC_SERVER_CHECKSUM, PAC_SIGNATURE_DATA, PAC_UPN_DNS_INFO, UPN_DNS_INFO
impacket.krb5.types	KerberosTime, Principal, Ticket
impacket.winregistry	hexdump

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
pyasn1	pyasn1	Imported directly; declared dependency
six	six	Imported directly; declared dependency

Output, Side Effects, and Required Privileges

• Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on krb5.asn1 / crypto / pac / types, pyasn1, and NDR serialization. S4U2SELF.dump() handles the exchange, while printPac() dispatches buffers.

Verification

• Syntax: python -m py_compile examples/getPac.py
• CLI: python examples/getPac.py -h
• Related test: tests/SMB_RPC/test_rpcrt.py
• Related test: tests/misc/test_crypto.py
• Related test: tests/misc/test_krb5_crypto.py
• Related test: tests/misc/test_krb5_gssapi.py
• Related test: tests/misc/test_pac_helpers.py
• Related test: tests/misc/test_winregistry.py