Impacket keylistattack.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Uses an RODC number and key to send Kerberos Key List requests for the long-term keys of specified or enumerated accounts.
| Item | Details |
|---|---|
| Implementation | examples/keylistattack.py |
| Category | Kerberos / Ticket Handling |
| Size | 283 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/keylistattack.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@]<KDC HostName or IP address>. Use these low-privilege credentials to authenticate over SMB and list domain users, or use LIST to parse a target file. |
-rodcNo | RODC krbtgt account number. |
-rodcKey | Read-only domain controller AES key. |
-full | Run against all domain users. This is noisy and may cause more TGS requests to be rejected. |
-debug | Enable debug logging. |
-ts | Add timestamps to log output. |
-domain | Fully qualified domain name (LIST mode only). |
-kdc | KDC hostname or FQDN (LIST mode only). |
-t | Target only the specified username (LIST mode only). |
-tf | File listing target usernames (LIST mode only). |
-domain-sid | Domain SID to put in the PAC in LIST mode. Recommended for domain controllers that strictly validate PACs. |
-hashes | Use NTLM hashes to authenticate over SMB and list domain users. |
-no-pass | Skip the password prompt (useful with -k). |
-k | Use Kerberos over SMB to list domain users. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid. |
-aesKey | 128- or 256-bit AES key for Kerberos authentication. |
-dc-ip | Domain controller IP address. Defaults to the domain (FQDN) in target. |
-target-ip | Target machine IP address. Defaults to target; useful when the target is a NetBIOS name that cannot be resolved. |
Related technology: KERB_KEY_LIST_REQ in Kerberos and KeyListSecrets in DPAPI / SAM / LSA / NTDS.
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command validates the credentials and RODC information, enumerates domain users through LDAP/DRS if needed, sends a key-list request to the KDC for each target user, and displays decrypted key material. -t / -tf and -full change how targets are selected.
In LIST mode, the command does not automatically obtain the domain SID from SAMR;
specify -domain-sid if PAC validation causes the request to be rejected.
How It Works
Section titled “How It Works”An RODC can limit which account secrets it holds. Kerberos Key List requests return a list of account keys under the conditions of an RODC ticket and the required privileges. The command uses the RODC number and krbtgt key to build the required Kerberos material and requests a key list for each target principal.
Targets come from one username, a file, or a domain user list obtained with
-full. Enumeration and KDC requests are separate paths, so failure to
enumerate through LDAP/DRS does not invalidate explicitly supplied targets.
Requests involve the RODC identity, ticket, nonce, and supported enctypes;
the encrypted response part is decrypted with the established key and correct key usage.
Returned keys differ in meaning by account, enctype, and key version. Distinguish receiving one response from retrieving every requested key for every requested account. Diagnose separately an uncached RODC secret, a replication-policy denial, and a mismatched KVNO or RODC number.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
KeyListDump | 49 | __init__(), connect(), run(), getAllDomainUsers() |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket.examples | logger |
impacket.examples.secretsdump | KeyListSecrets, RemoteOperations |
impacket.examples.utils | parse_target |
impacket.krb5 | constants |
impacket.krb5.types | Principal |
impacket.smbconnection | SMBConnection |
impacket | version |
External Packages (Direct Use)
Section titled “External Packages (Direct Use)”| Import Name | Distribution Package | Usage / Declaration Status |
|---|---|---|
pyasn1 | pyasn1 | Imported directly; declared dependency |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
- Depending on options, creates or updates a local file. Check how existing files are handled and the permissions on output containing secrets.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
When Changing the Implementation
Section titled “When Changing the Implementation”This command depends on Kerberos ASN.1/crypto, LDAP/DRS, and SMB/RPC helpers. KeyListDump.connect(), getAllDomainUsers(), and run() are the main boundaries. Preserve the relationship between the RODC key version and enctype.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/keylistattack.py - CLI:
python examples/keylistattack.py -h - Related test:
tests/misc/test_krb5_crypto.py - Related test:
tests/misc/test_krb5_gssapi.py