Impacket goldenPac.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Creates a ticket with a modified PAC to test MS14-068. The ticket can be saved, or its resulting privileges can be used for SMB-based execution.
| Item | Details |
|---|---|
| Implementation | examples/goldenPac.py |
| Category | Kerberos / Ticket Handling |
| Size | 1136 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/goldenPac.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@]<targetName> |
-ts | Add timestamps to log output. |
-debug | Enable debug logging. |
command | Command to run on the target, or arguments when using -c, without a path. Defaults to cmd.exe. Use None to skip PSEXEC and only save the ticket. |
-c | Upload a file for later execution; pass its arguments through command. |
-w | Write the golden ticket in ccache format to <pathname>. |
-dc-ip | Domain controller IP address, needed to obtain the user’s SID. Defaults to the domain (FQDN) in target. |
-target-ip | Target host IP address. Defaults to targetName. |
-hashes | NTLM hashes in LMHASH:NTHASH format. |
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command gathers domain and user SIDs and DC information through RPC and LDAP/Kerberos, builds and signs a TGT/PAC, and exchanges it with the KDC. With the resulting service ticket, it can save a ccache or install a PSEXEC-style service, use named-pipe I/O, and open an interactive shell. It cleans up the service and pipes on exit.
How It Works
Section titled “How It Works”To reproduce the vulnerable PAC-validation path in MS14-068, this command builds the ticket and PAC at a lower level than an ordinary Kerberos client. It first obtains the user SID, domain SID, and DC/forest information from SAMR/LSA and other sources, then establishes an initial KDC exchange with valid account credentials.
The core vulnerability test builds a PAC with privileged group information and embeds it in a request with a signature layout the KDC will accept. The resulting ticket and session key are either saved to a ccache or used to request an SMB service ticket. In the latter case, credentials are passed to the PSEXEC implementation in the same file to install a service and start a named-pipe shell.
Ticket creation and remote execution have different responsibilities, but this example combines them in one end-to-end flow. When changing it, verify PAC/NDR offsets, Kerberos key usage, and SMB service cleanup separately. Distinguish rejection by a patched KDC from network or authentication failures; an unsuccessful exploit is also a valid test result.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
RemComMessage | 69 | Structure and constant definitions |
RemComResponse | 79 | Structure and constant definitions |
PSEXEC | 91 | __init__(), run(), openPipe() |
Pipes | 220 | __init__(), connectPipe() |
RemoteStdOutPipe | 253 | __init__(), run() |
RemoteStdErrPipe | 280 | __init__(), run() |
RemoteShell | 298 | __init__(), connect_transferClient(), do_help(), do_shell(), do_get(), do_put(), do_lcd(), emptyline(), default(), send_data() |
RemoteStdInPipe | 407 | __init__(), run() |
MS14_068 | 417 | __init__(), getGoldenPAC(), getKerberosTGS(), getForestSid(), getDomainControllers(), getUserSID(), exploit() |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket.dcerpc.v5 | epm, samr, transport |
impacket.dcerpc.v5.drsuapi | DRSBind, DRS_EXTENSIONS_INT, DRS_EXT_GETCHGREPLY_V6, DRS_EXT_GETCHGREQ_V6, DRS_EXT_GETCHGREQ_V8, DRS_EXT_STRONG_ENCRYPTION, MSRPC_UUID_DRSUAPI, NTDSAPI_CLIENT_GUID, NULLGUID, hDRSDomainControllerInfo |
impacket.dcerpc.v5.dtypes | MAXIMUM_ALLOWED, RPC_SID |
impacket.dcerpc.v5.lsad | POLICY_INFORMATION_CLASS, hLsarOpenPolicy2, hLsarQueryInformationPolicy2 |
impacket.dcerpc.v5.lsat | MSRPC_UUID_LSAT, POLICY_LOOKUP_NAMES |
impacket.dcerpc.v5.nrpc | MSRPC_UUID_NRPC, hDsrGetDcNameEx |
impacket.dcerpc.v5.rpcrt | RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, TypeSerialization1 |
impacket.krb5.pac | KERB_SID_AND_ATTRIBUTES, KERB_VALIDATION_INFO, PACTYPE, PAC_CLIENT_INFO, PAC_CLIENT_INFO_TYPE, PAC_INFO_BUFFER, PAC_LOGON_INFO, PAC_PRIVSVR_CHECKSUM, PAC_SERVER_CHECKSUM, PAC_SIGNATURE_DATA, PKERB_VALIDATION_INFO |
impacket.examples | logger, remcomsvc, serviceinstall |
impacket.examples.utils | parse_target |
impacket.smbconnection | SMBConnection, smb |
impacket.structure | Structure |
impacket | version |
impacket.krb5.types | KerberosTime, Principal, Ticket |
impacket.krb5 | constants |
impacket.krb5.kerberosv5 | KerberosError, getKerberosTGS, getKerberosTGT, sendReceive |
impacket.krb5.asn1 | AD_IF_RELEVANT, AP_REQ, AS_REP, Authenticator, AuthorizationData, ETYPE_INFO2_ENTRY, EncASRepPart, EncTGSRepPart, KERB_PA_PAC_REQUEST, TGS_REP, TGS_REQ, seq_set, seq_set_iter |
impacket.krb5.crypto | Key |
impacket.dcerpc.v5.ndr | NDRULONG |
impacket.dcerpc.v5.samr | GROUP_MEMBERSHIP, NULL, SE_GROUP_ENABLED, SE_GROUP_ENABLED_BY_DEFAULT, SE_GROUP_MANDATORY, USER_DONT_EXPIRE_PASSWORD, USER_NORMAL_ACCOUNT |
impacket.krb5.ccache | CCache |
impacket.ntlm | compute_lmhash, compute_nthash |
External Packages (Direct Use)
Section titled “External Packages (Direct Use)”| Import Name | Distribution Package | Usage / Declaration Status |
|---|---|---|
Cryptodome | pycryptodomex | Imported directly; declared dependency |
pyasn1 | pyasn1 | Imported directly; declared dependency |
six | six | Imported directly; declared dependency |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
- Depending on options, creates or updates a local file. Check how existing files are handled and the permissions on output containing secrets.
- Some paths use temporary resources such as remote services, tasks, files, shares, and WMI/RPC resources. Cleaning them up after abnormal termination is part of the behavior contract.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
- Even without an explicitly named cleanup function, check for a
finally-equivalent path and closure or deletion of protocol handles.
When Changing the Implementation
Section titled “When Changing the Implementation”This command depends on krb5.*, PAC/NDR, SAMR/LSA/RPC, SMB, and examples.remcomsvc / serviceinstall. MS14_068 handles ticket processing; the PSEXEC classes in the same file handle execution.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/goldenPac.py - CLI:
python examples/goldenPac.py -h - Related test:
tests/SMB_RPC/test_ndr.py - Related test:
tests/SMB_RPC/test_ntlm.py - Related test:
tests/SMB_RPC/test_rpcrt.py - Related test:
tests/dcerpc/test_drsuapi.py - Related test:
tests/dcerpc/test_lsad.py - Related test:
tests/dcerpc/test_lsat.py