Impacket kintercept.py

Back to the Category Index / Back to the Command Index

Overview

A development proxy that relays Kerberos TCP traffic and observes or modifies requests and responses.

Item	Details
Implementation	examples/kintercept.py
Category	Kerberos / Ticket Handling
Size	296 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/kintercept.py -h for the current option definitions.

Argument	Description
server	Target server address.
--server-port	Target server port (default: 88).
--listen-port	Listening port (default: 88).
--listen-addr	Address to listen on.
--request-handler	Request handler, for example s4u2else:user.
--reply-handler	Reply handler, for example tgs-rep-user:user.
-ts	Add timestamps to log output.
-debug	Enable debug logging.

Detailed Processing Flow

A listening socket accepts connections, and InterceptConn forwards data asynchronously between the client and upstream KDC. It buffers Kerberos TCP length-prefixed frames, passes requests and replies through the specified handlers, and sends them to the other side. The included handlers modify parts of S4U2self requests and replies.

How It Works

Kerberos over TCP consists of a four-byte network-order length followed by an ASN.1 message of that length. The proxy pairs a client connection with an upstream KDC connection and buffers both byte streams until a complete frame is available for a handler. One TCP read does not necessarily correspond to one Kerberos message.

Request and reply handlers observe or modify decoded messages, then place the re-encoded length and payload on the outbound queue. The included S4U handlers target specific request and reply fields, but unknown message types must pass through unchanged. Failing to update the ASN.1 or outer TCP length after a change can corrupt subsequent frames.

Each direction may be written asynchronously in part, so track the sent offset, EOF, and the peer’s half-close. The current asyncore dependency does not work on Python 3.12 or later. A move to selectors or asyncio must preserve buffering and backpressure behavior. The proxy does not generate KDC responses itself.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
InterceptConn	108	__init__(), recv(), forward_data(), buffer_empty(), max_read_size(), readable(), handle_read(), handle_eof(), need_to_send_eof(), writable(), handle_write(), handle_close()
InterceptConnFactory	220	__init__(), produce()
InterceptServer	233	__init__(), intercept_conns(), handle_accept()
process_s4u2else_req()	49	Module function
mod_tgs_rep_user()	95	Module function
InterceptKRB5Tcp()	189	Module function
parse_args()	264	Module function

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.krb5	constants
impacket.krb5.crypto	Cksumtype
impacket.krb5.asn1	PA_FOR_USER_ENC, TGS_REP, TGS_REQ, seq_set
impacket.krb5.types	Principal
impacket.examples	logger

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
pyasn1	pyasn1	Imported directly; declared dependency

Output, Side Effects, and Required Privileges

• Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
• Starts a listening socket or long-running loop. Check the bind address, port, shutdown method, and shared state under concurrent connections.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
• handle_close() handles cleanup. Check that new early returns and exception paths still reach it.
• On Python 3.12 or later, importing asyncore fails. Treat this compatibility issue separately from network failures.
• Ensure stop requests, client disconnects, partial reads and writes, and worker exceptions do not leave the entire listener in an inconsistent state.

When Changing the Implementation

This command depends on the former standard-library module asyncore, krb5.asn1, and pyasn1. asyncore was removed in Python 3.12, so the current implementation cannot be imported unchanged on the project’s supported Python 3.12/3.13. When replacing it, preserve InterceptConn partial read/write behavior and Kerberos TCP message boundaries; do not assume one recv returns one message.

Verification

• Syntax: python -m py_compile examples/kintercept.py
• CLI: python examples/kintercept.py -h
• Related test: tests/misc/test_crypto.py
• Related test: tests/misc/test_krb5_crypto.py
• Related test: tests/misc/test_krb5_gssapi.py