Impacket getTGT.py

Back to the Category Index / Back to the Command Index

Overview

Requests a TGT using a password, NT hash, AES key, or keytab, and saves it to a ccache.

Item	Details
Implementation	examples/getTGT.py
Category	Kerberos / Ticket Handling
Size	120 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/getTGT.py -h for the current option definitions.

Argument	Description
identity	[domain/]username[:password]
-ts	Add timestamps to log output.
-debug	Enable debug logging.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.
-dc-ip	Domain controller IP address. Defaults to the domain (FQDN) in identity.
-service	Request a service ticket directly through an AS-REQ.
-principalType	Principal type: NT_UNKNOWN, NT_PRINCIPAL, NT_SRV_INST, NT_SRV_HST, NT_SRV_XHST, NT_UID, NT_SMTP_NAME, NT_ENTERPRISE, NT_WELLKNOWN, NT_SRV_HST_DOMAIN, NT_MS_PRINCIPAL, NT_MS_PRINCIPAL_AND_ID, or NT_ENT_PRINCIPAL_AND_ID (default: NT_PRINCIPAL).

Related technology: AS-REQ/AS-REP, enctype selection, and key usages 1 and 3 in Kerberos.

Detailed Processing Flow

The command parses the identity and principal type, converts credentials into a binary key, and calls getKerberosTGT(). On success, it passes the KDC response, cipher, and session key to logic equivalent to CCache.fromTGT(), then saves <principal>.ccache. -service can change the requested principal.

How It Works

A TGT lets the client principal use the KDC’s Ticket Granting Service. run() chooses between the supplied password, LM/NT hashes, or AES key, converts the principal name type and domain into a Principal, and passes them to getKerberosTGT(). For passwords, the long-term key is derived using the salt and enctype in the KDC’s pre-authentication response.

After a successful AS exchange, the return values include the encoded AS-REP, the ticket’s cipher profile, and the client/KDC session key obtained by decrypting the AS-REP. The ticket itself is encrypted with the krbtgt key, so the client need not read its contents. Subsequent TGS-REQs use the ticket and session key together; saveTicket() serializes them as a ccache credential.

With -service, the AS-REQ requests a service other than the usual krbtgt/domain. -principalType affects how the KDC interprets the principal; it is not merely a display format. On failure, distinguish pre-authentication type mismatches, clock skew, salt/key mismatches, and unreachable KDCs. Do not leave an empty or corrupt ccache as a successful artifact.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
GETTGT	35	__init__(), saveTicket(), run()

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.examples	logger
impacket.examples.utils	parse_identity
impacket.krb5.kerberosv5	getKerberosTGT
impacket.krb5	constants
impacket.krb5.types	Principal
impacket.krb5.ccache	CCache

Output, Side Effects, and Required Privileges

• Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
• Depending on options, creates or updates a local file. Check how existing files are handled and the permissions on output containing secrets.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command uses krb5.kerberosv5 / types / constants and the shared identity parser. Since GETTGT.run() and saveTicket() form a small implementation, keep key selection separate from saving when adding authentication methods.

Verification

• Syntax: python -m py_compile examples/getTGT.py
• CLI: python examples/getTGT.py -h
• Related test: tests/misc/test_ccache.py
• Related test: tests/misc/test_krb5_crypto.py
• Related test: tests/misc/test_krb5_gssapi.py