Impacket ticketer.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Creates Golden or Silver Tickets from SIDs, groups, and keys, or modifies an existing ticket and PAC and saves the result as a ccache file.
| Item | Details |
|---|---|
| Implementation | examples/ticketer.py |
| Category | Kerberos / ticket handling |
| Size | 1,189 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/ticketer.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | Username for the new ticket |
-spn | SPN of the target service for a Silver Ticket; if omitted, create a Golden Ticket |
-request | Request a ticket from the domain and clone it, changing only the supplied information; requires -user |
-domain | Fully qualified domain name (for example, contoso.com); required |
-domain-sid | SID of the target domain for which the ticket is generated; required |
-aesKey | AES key for signing the ticket (128 or 256 bits) |
-nthash | NT hash for signing the ticket |
-keytab | Read SPN keys from a keytab file (Silver Ticket only) |
-groups | Comma-separated list of groups for the user (default: 513, 512, 520, 518, 519) |
-user-id | User ID for the ticket (default: 500) |
-extra-sid | Comma-separated list of ExtraSids to include in the ticket PAC |
-extra-pac | Add extra PAC information (UPN_DNS) to the ticket |
-old-pac | Use the old PAC structure, excluding PAC_ATTRIBUTES_INFO and PAC_REQUESTOR |
-duration | Hours until the ticket expires (default: 2436510); ignored with -request, which retains the KDC-issued lifetime |
-ts | Add a timestamp to each log message |
-debug | Enable debug output |
-user | Domain and username to use with -request; they may differ from the target domain and username |
-password | Password for the domain and username |
-hashes | NTLM hashes in LMHASH:NTHASH format |
-dc-ip | Domain controller IP address; if omitted, use the domain name (FQDN) specified in the target parameter |
-impersonate | For a Sapphire Ticket, impersonate this username through S4U2Self+U2U to request a service ticket and extract its PAC for the new ticket |
Detailed processing flow
Section titled “Detailed processing flow”The tool validates keytab, password, hash, AES key, and domain information, then builds a basic ticket and PAC buffers. With -request, it obtains a KDC response as a template. After applying validation information, UPN/DNS, attributes, requestor information, and additional SIDs, it signs the PAC checksums and signs and encrypts the ticket’s encrypted part according to the enctype, then passes it to saveTicket().
How it works
Section titled “How it works”This command does more than request a normally issued ticket from the KDC: it builds
and signs the ticket and PAC on the client side. createBasicTicket() creates the
AS-REP/TGS-REP structure and EncTicketPart, while createBasicPac() places PAC buffers
for validation information, client information, checksum placeholders, and other data.
It converts the domain SID, user RID, and group RIDs into authorization data here.
customizeTicket() applies groups, extra SIDs, UPN/DNS, requestor information, PAC attributes,
and lifetime settings. With -request, it uses an existing KDC response as a template
and retains KDC-issued PAC_REQUESTOR and PAC_ATTRIBUTES when conditions allow.
If those values cannot be extracted, it falls back to generated values. This can
cause validation to fail on a patched KDC. Adding a PAC buffer changes offsets
and alignment, so the directory’s sizes and offsets must be recalculated as well as its contents.
signEncryptTicket() first calculates the PAC checksum fields using the prescribed values.
It signs them in the required order of server and KDC checksum dependencies, then encrypts
the ticket’s encrypted part with the service or krbtgt key and the key usage. RC4 and AES differ
in key size, checksum algorithm, and cipher profile. Finally, it saves a ccache containing
the session key so a later client can use the generated ticket.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
TICKETER | 90 | __init__(), getFileTime(), getPadLength(), getBlockLength(), loadKeysFromKeytab(), createBasicValidationInfo(), createBasicPac(), createUpnDnsPac(), createAttributesInfoPac(), createRequestorInfoPac(), createBasicTicket(), getKerberosS4U2SelfU2U(), and others |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | version |
impacket.dcerpc.v5.dtypes | RPC_SID, SID |
impacket.dcerpc.v5.ndr | NDRULONG |
impacket.dcerpc.v5.samr | GROUP_MEMBERSHIP, NULL, SE_GROUP_ENABLED, SE_GROUP_ENABLED_BY_DEFAULT, SE_GROUP_MANDATORY, USER_DONT_EXPIRE_PASSWORD, USER_NORMAL_ACCOUNT |
impacket.examples | logger |
impacket.krb5.asn1 | AD_IF_RELEVANT, AP_REQ, AS_REP, Authenticator, AuthorizationData, ETYPE_INFO2, EncASRepPart, EncTGSRepPart, EncTicketPart, PA_FOR_USER_ENC, TGS_REP, TGS_REQ, Ticket, seq_set, seq_set_iter |
impacket.krb5.constants | ApplicationTagNumbers, AuthorizationDataType, ChecksumTypes, EncryptionTypes, KERB_NON_KERB_CKSUM_SALT, PreAuthenticationDataTypes, PrincipalNameType, ProtocolVersionNumber, TicketFlags, encodeFlags |
impacket.krb5.keytab | Keytab |
impacket.krb5.crypto | Enctype, Key, _AES256CTS, _HMACMD5, _enctype_table, get_kerberos_key_for_enctype, string_to_key |
impacket.krb5.pac | KERB_SID_AND_ATTRIBUTES, KERB_VALIDATION_INFO, PAC_ATTRIBUTES_INFO, PAC_ATTRIBUTE_INFO, PAC_CLIENT_INFO, PAC_CLIENT_INFO_TYPE, PAC_LOGON_INFO, PAC_PRIVSVR_CHECKSUM, PAC_REQUESTOR, PAC_REQUESTOR_INFO, PAC_SERVER_CHECKSUM, PAC_SIGNATURE_DATA, PAC_UPN_DNS_INFO, PKERB_SID_AND_ATTRIBUTES_ARRAY, UPN_DNS_INFO_FULL, VALIDATION_INFO |
impacket.krb5.types | KerberosTime, Principal, Ticket |
impacket.krb5.kerberosv5 | getKerberosTGS, getKerberosTGT, sendReceive |
impacket.krb5 | constants, pac |
impacket.winregistry | hexdump |
impacket.krb5.ccache | CCache |
External packages (used directly)
Section titled “External packages (used directly)”| Import name | Distribution package | Import path and declaration status |
|---|---|---|
pyasn1 | pyasn1 | Imported directly; declared |
six | six | Imported directly; declared |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
- Options may create or update local files. Check how existing files are handled and the permissions on output containing secrets.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
When changing the implementation
Section titled “When changing the implementation”The code depends on krb5.asn1, constants, crypto, pac, keytab, NDR/SID, and pyasn1. The create, customize, sign, and save stages in TICKETER are the main extension points. PAC buffer offsets and the signing order are part of the wire contract.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/ticketer.py - CLI:
python examples/ticketer.py -h - Related test:
tests/misc/test_ticketer.py - Related test:
tests/SMB_RPC/test_ndr.py - Related test:
tests/dcerpc/test_samr.py - Related test:
tests/misc/test_ccache.py - Related test:
tests/misc/test_crypto.py - Related test:
tests/misc/test_dcerpc_v5_ndr.py - Related test:
tests/misc/test_krb5_crypto.py