.kirbi is the common Windows Kerberos ticket format used by Rubeus, Mimikatz, and other Windows-side tooling. We convert .kirbi to ccache when we want to use the ticket from Linux with Impacket, smbclient, ldapsearch, or other MIT Kerberos-aware tooling.
Convert with Impacket:
ticketConverter.py ticket.kirbi ticket.ccache
Alternative explicit path:
python3 /path/to/impacket/examples/ticketConverter.py ticket.kirbi ticket.ccache
Convert with minikerberos:
minikerberos-kirbi2ccache ticket.kirbi ticket.ccache
Load the cache:
export KRB5CCNAME=FILE:$(pwd)/ticket.ccache
klist
Use the cache with Impacket:
psexec.py -k -no-pass ootw.local/user@target.ootw.local
wmiexec.py -k -no-pass ootw.local/user@target.ootw.local
smbexec.py -k -no-pass ootw.local/user@target.ootw.local
Use the cache with LDAP and SMB:
ldapsearch -Y GSSAPI -H ldap://dc01.ootw.local -b 'DC=ootw,DC=local' '(sAMAccountName=student)'
smbclient -k //dc01.ootw.local/C$
Validate the SPN before assuming the ticket is wrong:
klist -e
If the cache contains HTTP/web.ootw.local, it will not authenticate to CIFS/dc01.ootw.local. Request or convert the correct service ticket.