Impacket ticketConverter.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Converts between MIT/Heimdal ccache files and Windows KRB-CRED (kirbi) files. It also supports Base64 input and output.
| Item | Details |
|---|---|
| Implementation | examples/ticketConverter.py |
| Category | Kerberos / ticket handling |
| Size | 113 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/ticketConverter.py -h for the current option definitions.
| Argument | Description |
|---|---|
input_file | File in kirbi (KRB-CRED) or ccache format |
output_file | Output file |
-b / --base64 | Decode a Base64-encoded input ticket, removing wrappers if present |
Detailed processing flow
Section titled “Detailed processing flow”The magic bytes or header identify the input format. With Base64 input, the converter removes wrappers and whitespace before decoding. It converts kirbi to ccache through CCache.loadKirbiFile() and ccache to kirbi through CCache.toKRBCRED(), then saves the result at the specified path. It does not write output for an unknown format.
How it works
Section titled “How it works”Ccache and kirbi represent the same Kerberos credentials in different container models. A ccache can hold multiple credentials and principal, key, and time information; a kirbi file holds a ticket list and encrypted part as a KRB-CRED ASN.1 message. Conversion does not break encryption. It transfers the stored tickets and session metadata into another format.
Input detection uses the initial bytes or header and the ASN.1 structure. With --base64,
the converter removes PEM-style wrappers, whitespace, and newlines, creates a temporary binary file, and passes it through the same detection.
For kirbi input, CCache.loadKirbiFile() moves the principal, time, and key into a credential
entry. In the other direction, toKRBCRED() builds the KRB-CRED ticket-info.
Some metadata and handling of multiple credentials do not map perfectly between formats. Check that the output parses and that the principal, session key, ticket bytes, and validity times still match after a round trip. For an unknown format or Base64 decoding failure, avoid truncating the output file before validation.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
parse_args() | 40 | Module function |
main() | 50 | Module function |
is_kirbi_file() | 83 | Module function |
is_ccache_file() | 89 | Module function |
convert_kirbi_to_ccache() | 95 | Module function |
convert_ccache_to_kirbi() | 100 | Module function |
base64_decode_with_unwrap() | 105 | Module function |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | version |
impacket.krb5.ccache | CCache |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The main operation parses local files. Treat input as untrusted: validate offsets, lengths, and format identifiers before accessing data.
- Options may create or update local files. Check how existing files are handled and the permissions on output containing secrets.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
When changing the implementation
Section titled “When changing the implementation”The main dependencies are impacket.krb5.ccache.CCache and the standard base64, struct, and tempfile modules. Format detection, conversion, and CLI handling are separate functions, making round-trip tests easy to add.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/ticketConverter.py - CLI:
python examples/ticketConverter.py -h - Related test:
tests/misc/test_ccache.py