impacket
impacket copied to clipboard
Added ability to set the RENEW ticket option to renew a TGT
per discussion in #1529
Awesome! Didn't test it yet but it's a great addition
Hello, I've been testing this PR. From what understand, the use case, involves to use getST.py to request a TGT, which at the beggining sound a bit confusing. Despite this, from my test, I can see that -renew flag keeps the same session key of the old ticket, used also for auhentication. That's not the case when -renew flag is not being passed. Please confirm that this is the expected behavior. Thanks!
python getST.py -spn krbtgt/DOMAIN.COM domain.com/Administrator:password -dc-ip 1.1.1.1
Impacket v0.11.0 - Copyright 2023 Fortra
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Getting ST for user
[*] Saving ticket in Administrator.ccache
└─$ python describeTicket.py Administrator.ccache
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Number of credentials in cache: 1
[*] Parsing credential[0]:
[*] Ticket Session Key : 1c7d8facbd37ae6a45d6724a086612dd
[*] User Name : Administrator
[*] User Realm : DOMAIN.COM
[*] Service Name : krbtgt/DOMAIN.COM
[*] Service Realm : DOMAIN.COM
[*] Start Time : 22/08/2024 12:25:11 PM
[*] End Time : 22/08/2024 22:25:11 PM
[*] RenewTill : 23/08/2024 12:26:04 PM
[*] Flags : (0x40a10000) forwardable, renewable, pre_authent, enc_pa_rep
└─$ KRB5CCNAME=Administrator.ccache python getST.py -k -no-pass -spn krbtgt/DOMAIN.COM domain.com/Administrator -dc-ip 1.1.1.1 -renew
└─$ python describeTicket.py Administrator.ccache
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Number of credentials in cache: 1
[*] Parsing credential[0]:
[*] Ticket Session Key : 1c7d8facbd37ae6a45d6724a086612dd
[*] User Name : Administrator
[*] User Realm : DOMAIN.COM
[*] Service Name : krbtgt/DOMAIN.COM
[*] Service Realm : DOMAIN.COM
[*] Start Time : 22/08/2024 12:25:25 PM
[*] End Time : 22/08/2024 22:25:25 PM
[*] RenewTill : 23/08/2024 12:26:04 PM
[*] Flags : (0x40a10000) forwardable, renewable, pre_authent, enc_pa_rep
KRB5CCNAME=Administrator.ccache python getST.py -k -no-pass -spn krbtgt/DOMAIN.COM domain.com/Administrator -dc-ip 1.1.1.1
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Getting ST for user
[*] Saving ticket in Administrator.ccache
python describeTicket.py Administrator.ccache
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Number of credentials in cache: 1
[*] Parsing credential[0]:
[*] Ticket Session Key : f0893ce585c39d386814511f46ea8299
[*] User Name : Administrator
[*] User Realm : DOMAIN.COM
[*] Service Name : krbtgt/DOMAIN.COM
[*] Service Realm : DOMAIN.COM
[*] Start Time : 22/08/2024 12:27:40 PM
[*] End Time : 22/08/2024 22:25:25 PM
[*] RenewTill : 23/08/2024 12:26:04 PM
[*] Flags : (0x40a10000) forwardable, renewable, pre_authent, enc_pa_rep