Impacket getST.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Handles TGS requests, S4U2self/S4U2proxy, U2U, and ticket renewal, saving the resulting service ticket to a ccache.
| Item | Details |
|---|---|
| Implementation | examples/getST.py |
| Category | Kerberos / Ticket Handling |
| Size | 918 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/getST.py -h for the current option definitions.
| Argument | Description |
|---|---|
identity | [domain/]username[:password] |
-spn | Target service SPN (service/server) for the requested service ticket. |
-altservice | New service name/SPN to set in the ticket. |
-dmsa | Use delegated managed service accounts (DMSA). |
-impersonate | Username to impersonate through S4U2self when requesting a service ticket; this works only if the supplied identity may delegate to the specified SPN. |
-additional-ticket | Include a forwardable service ticket in an S4U2proxy request for RBCD plus Kerberos-only constrained delegation. |
-ts | Add timestamps to log output. |
-debug | Enable debug logging. |
-u2u | Request a user-to-user ticket. |
-self | Perform only S4U2self, without S4U2proxy. |
-force-forwardable | Force the S4U2self service ticket to be forwardable. For best results, supply -hashes and -aesKey for the specified identity. This can impersonate protected users and bypass “Kerberos-only” constrained delegation restrictions; see CVE-2020-17049. |
-renew | Set the RENEW ticket option to renew the TGT used for authentication. Set -spn to krbtgt/DOMAINFQDN. |
-hashes | NTLM hashes in LMHASH:NTHASH format. |
-no-pass | Skip the password prompt (useful with -k). |
-k | Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid. |
-aesKey | 128- or 256-bit AES key for Kerberos authentication. |
-dc-ip | Domain controller IP address. Defaults to the domain (FQDN) in identity. |
Related technology: TGS, S4U2self/S4U2proxy, U2U, and PAC in Kerberos. S4U is handled in this file, rather than by getKerberosTGS.
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command obtains a TGT from a password, hash, AES key, or existing ccache, then follows the ordinary TGS, impersonation, additional-ticket, dMSA, or renewal path according to the options. It validates the KDC response, applies adjustments such as -altservice where needed, and writes a ccache through saveTicket().
How It Works
Section titled “How It Works”This command brings several service-ticket acquisition paths into one CLI.
The ordinary path prepares a TGT and its session key and sends a TGS-REQ
for the target SPN. It uses a cached TGT only if the requested username
and domain match; otherwise, it warns and requests a new TGT.
With -impersonate, S4U2self obtains an evidence ticket representing
another user’s identity, then S4U2proxy exchanges it for the final service ticket if needed.
For S4U2proxy, the evidence ticket, delegated target SPN, PAC options,
and ticket flags together determine the KDC’s authorization decision.
-additional-ticket uses an externally supplied evidence ticket;
-u2u uses another ticket’s session key; -renew extends the lifetime
of a renewable ticket. These paths use different ASN.1 request fields
and key usages, so they are not forced into one generic TGS-request function.
The command checks the response’s client and service principals, flags,
session key, and encryption type before creating a CCache credential.
-altservice changes the service-principal representation before saving,
but does not change the key of the already encrypted ticket. For flag
changes such as -force-forwardable, first verify that a key is available to decrypt and re-encrypt the ticket’s encrypted part.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
GETST | 81 | __init__(), saveTicket(), doS4U2ProxyWithAdditionalTicket(), doS4U(), run() |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket | version |
impacket.examples | logger |
impacket.examples.utils | parse_identity |
impacket.krb5 | ccache, constants, crypto, types |
impacket.krb5.asn1 | AP_REQ, AS_REP, Authenticator, EncTGSRepPart, EncTicketPart, KERB_DMSA_KEY_PACKAGE, PA_FOR_USER_ENC, PA_PAC_OPTIONS, PA_S4U_X509_USER, S4UUserID, TGS_REP, TGS_REQ, Ticket, seq_set, seq_set_iter |
impacket.krb5.ccache | CCache, Credential |
impacket.krb5.crypto | Cksumtype, Enctype, Key, _AES256CTS, _HMACMD5, _enctype_table, _get_checksum_profile, string_to_key |
impacket.krb5.constants | ApplicationTagNumbers, TicketFlags, encodeFlags |
impacket.krb5.kerberosv5 | getKerberosTGS, getKerberosTGT, sendReceive |
impacket.krb5.types | KerberosTime, Principal, Ticket |
impacket.ntlm | compute_nthash |
impacket.winregistry | hexdump |
External Packages (Direct Use)
Section titled “External Packages (Direct Use)”| Import Name | Distribution Package | Usage / Declaration Status |
|---|---|---|
pyasn1 | pyasn1 | Imported directly; declared dependency |
six | six | Imported directly; declared dependency |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
- Depending on options, creates or updates a local file. Check how existing files are handled and the permissions on output containing secrets.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
When Changing the Implementation
Section titled “When Changing the Implementation”This command depends on krb5.asn1 / constants / crypto / kerberosv5 / ccache, pyasn1, and NT-hash helpers. Its main entry points are GETST.run(), doS4U(), and doS4U2ProxyWithAdditionalTicket(). Preserve the relationship between ticket flags and session keys.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/getST.py - CLI:
python examples/getST.py -h - Related test:
tests/SMB_RPC/test_ntlm.py - Related test:
tests/misc/test_ccache.py - Related test:
tests/misc/test_crypto.py - Related test:
tests/misc/test_krb5_crypto.py - Related test:
tests/misc/test_krb5_gssapi.py - Related test:
tests/misc/test_winregistry.py