Kerb
Commands for working with Kerberos authentication
Synopsis
Subcommands
| Command |
Description |
| asreq |
Requests a TGT from the KDC. |
| changepw |
Changes an account password |
| forge |
Forges a ticket |
| getasinfo |
Gets server time and encryption types (with salts) for a user account. |
| keytab |
Display and edit keytab files |
| renew |
Renews a ticket |
| s2k |
Generates a protocol key from a string, such as a password |
| select |
Selects and displays tickets from a file. |
| setpw |
Sets the password of (another) account |
| tgsreq |
Requests a ticket from the KDC. |
For help on a subcommand, use Kerb <subcommand> -h
Kerb asreq
Requests a TGT from the KDC.
Synopsis
Kerb asreq [options] <UserName> <Kdc>
Parameters
| Name |
Aliases |
Value |
Description |
| <UserName> |
|
<UserPrincipalName> |
Name of user (no domain) |
| <Kdc> |
|
<EndPoint> |
Host name or address of KDC |
Options
| Name |
Aliases |
Value |
Description |
| -ArmorTicket |
|
<String> |
Name of file containing armor ticket |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -S, -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -Target |
|
<SecurityPrincipalName[]> |
SPNs to request ticket(s) for |
| -TicketComment |
|
<String> |
Comment to associate with ticket |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES 128 key |
| -DesKey |
|
<HexString> |
DES key |
| -EncTypes |
|
<EType[]> |
Encryption types to request in response |
| |
|
|
Possible values: |
| |
|
|
DesCbcMd5 |
| |
|
|
DesCbcCrc |
| |
|
|
Rc4Hmac |
| |
|
|
Rc4HmacExp |
| |
|
|
Aes128CtsHmacSha1_96 |
| |
|
|
Aes256CtsHmacSha1_96 |
| |
|
|
DsaWithSha1 |
| |
|
|
Md5WithRsa |
| |
|
|
Sha1WithRsa |
| |
|
|
Rc2Cbc |
| |
|
|
Rsa |
| |
|
|
RsaesOaep |
| |
|
|
DesEde3Cbc |
| -EndTime |
|
<DateTime> |
End time |
| -F, -Forwardable |
|
<SwitchParam> |
Requests a forwardable ticket |
| -Keytab |
|
<String> |
Name of keytab file |
| -N, -NtlmHash |
|
<HexString> |
NTLM hash (hex-encoded, no colons) |
| -Password |
|
<String> |
Password |
| -Postdate |
|
<DateTime> |
Requests a postdated ticket with the specified start date |
| -Proxiable |
|
<SwitchParam> |
Requests a forwardable ticket |
| -Realm |
|
<String> |
Name of realm (domain) |
| -Renewable |
|
<SwitchParam> |
Requests a renewable ticket |
| -RenewableOk |
|
<SwitchParam> |
Accepts a renewable ticket if the end time is over the limit |
| -RenewTill |
|
<DateTime> |
Requests a ticket renewable until the specified time (implies -Renewable) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
| -W, -Workstation |
|
<String> |
Name of client workstation |
Connection
| Name |
Aliases |
Value |
Description |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -Append |
|
<SwitchParam> |
Appends to the output file, if it exists |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -OutputFileName |
|
<String> |
Name of file to write ticket to |
| -Overwrite |
|
<SwitchParam> |
Overwrites the output file, if it exists |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
This command sends an AS-REQ to the KDC to request a ticket-granting ticket.
The command line must include either a password or a hex-encoded key that is
used both for preauthentication as well as to decrypt the response. When
specifying the NTLM hash, specify just the NTLM portion with no colon.
The provided credential determines the encryption type of the response. If you
provide a password then all encryption types supported by Kerb asreq are
presented. To override this, use -EncTypes to specify a list of encryption
types to accept. Note that this only effects the encryption used in the
response and not the preauthorization data.
Dates/times are interpreted as local time unless otherwise specified. If only
a time is supplied, the assumed date is today.
Note that the ticket flags and time parameters affect the request sent to the
KDC. However, the KDC is free to ignore them; specifying an option doesn’t
guarantee that the ticket will have the requested option.
If you don’t specify any options for the ticket, Kerb asreq uses default
values, requesting a ticket that expires 10 hours from now with the options
Canonicalize, RenewableOk, Renewable, and Forwardable. If any options are
specified, then no default values are applied and only the options specified
are used.
Examples
Example 1 - Requesting a TGT with a user name / password
Kerb asreq -UserName milchick -Realm LUMON -Password Br3@kr00m! -Kdc LUMON-DC1 -v -OutputFileName milchick-tgt.kirbi -Overwrite
Example 2 - Requesting a TGT with a UPN / password
Kerb asreq -UserName milchick@LUMON.IND -Password Br3@kr00m! -Kdc LUMON-DC1 -v -OutputFileName milchick-tgt.kirbi -Overwrite
Example 3 - Requesting a TGT with PKINIT
Kerb asreq -UserName milchick@LUMON.IND -UserCert milchick.pfx -UserKeyPassword password -Kdc LUMON-DC1 -v -OutputFileName milchick-tgt.kirbi -Overwrite
Example 4 - Requesting a TGT with a password request Rc4Hmac
Kerb asreq -UserName milchick -Realm LUMON -Password Br3@kr00m! -EncTypes Rc4Hmac -Kdc 10.66.0.11 -v -OutputFileName milchick-tgt.kirbi -Overwrite
Example 5 - Requesting a TGT with a password request AES 128 or AES 256
Kerb asreq -UserName milchick -Realm LUMON -Password Br3@kr00m! -EncTypes Aes128CtsHmacSha1_96, Aes256CtsHmacSha1_96 -Kdc 10.66.0.11 -v -OutputFileName milchick-tgt.kirbi -Overwrite
Example 6 - Requesting a TGT with an NTLM Hash
Kerb asreq -UserName milchick -NtlmHash B406A01772D0AD225D7B1C67DD81496F -Kdc 10.66.0.11 -Realm LUMON -v -OutputFileName milchick-tgt.kirbi -Overwrite
Example 7 - Requesting a TGT with an AES 128 key
Kerb asreq -UserName milchick -AesKey c5673764957bc2839e367ba7b82f32e1 -Kdc 10.66.0.11 -Realm LUMON -v -OutputFileName milchick-tgt.kirbi -Overwrite
Example 8 - Requesting a TGT with an AES 256 key
Kerb asreq -UserName milchick -AesKey 76332deee4296dcb20200888630755268e605c8576e50ff38db2d8b92351f4e4 -Kdc 10.66.0.11 -Realm LUMON -v -OutputFileName milchick-tgt.kirbi -Overwrite
Kerb changepw
Changes an account password
Synopsis
Kerb changepw [options] <UserName> <Kdc> <NewPassword>
Parameters
| Name |
Aliases |
Value |
Description |
| <UserName> |
|
<UserPrincipalName> |
Name of user (no domain) |
| <Kdc> |
|
<EndPoint> |
Host name or address of KDC |
| <NewPassword> |
|
<String> |
New password to set |
Options
| Name |
Aliases |
Value |
Description |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -S, -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -A, -AesKey |
|
<HexString> |
AES 128 key |
| -DesKey |
|
<HexString> |
DES key |
| -Keytab |
|
<String> |
Name of keytab file |
| -NtlmHash |
|
<HexString> |
NTLM hash (hex-encoded, no colons) |
| -P, -Password |
|
<String> |
Password |
| -R, -Realm |
|
<String> |
Name of realm (domain) |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
| -W, -Workstation |
|
<String> |
Name of client workstation |
Connection
| Name |
Aliases |
Value |
Description |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
Kerb changepw uses the Kerberos Change Password protocol and can only be used
to change the password of the authenticating user. To set the password of
another user, use the setpw command.
This protocol requires an initial ticket. That is, it requires a ticket from
an ASREQ/ASREP exchange and not from a TGSREQ/TGSREP exchange. Therefore, this
command requires credentials and does not accept a ticket as a parameter. The
setpw command does not have this restriction and accepts a ticket as a
parameter.
Examples
Example 1 - milchick changing his own password
Kerb changepw milchick@LUMON 10.66.0.11 -Password EradicateFolly! Br3@kr00m!
Kerb forge
Forges a ticket
Synopsis
Kerb forge [options] -TicketEType <EType> -TicketKey <HexString> -UserSid <SecurityIdentifier> -UserName <UserPrincipalName> <Target>
Parameters
| Name |
Aliases |
Value |
Description |
| <Target> |
|
<SecurityPrincipalName[]> |
Target SPN |
Options
| Name |
Aliases |
Value |
Description |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -DomainRids |
|
<UInt32[]> |
Group RIDs, relative to the user domain |
| -E, -ExtraSids |
|
<SecurityIdentifier[]> |
Extra group SIDs |
| -F, -FullName |
|
<String> |
User’s full name |
| -HomeDirectory |
|
<String> |
UNC path of home directory |
| -HomeDrive |
|
<String> |
Home Drive (e.g. H:) |
| -LogonScript |
|
<String> |
UNC path of logon script |
| -LogonServer |
|
<String> |
Name of logon server |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -PrimaryGroupId |
|
<UInt32> |
Primary group ID |
| -ProfilePath |
|
<String> |
UNC path of user profile |
| -Realm |
|
<String> |
Ticket realm |
| -ResourceDomainSid |
|
<SecurityIdentifier> |
Domain of SID containing resource |
| -ResourceGroupRids |
|
<UInt32[]> |
Group RIDs, relative to the resource domain |
| -S, -ServiceRealm |
|
<String> |
Service realm |
| -TicketEType |
|
<EType> |
Ticket encryption type |
| |
|
|
Possible values: |
| |
|
|
DesCbcMd5 |
| |
|
|
DesCbcCrc |
| |
|
|
Rc4Hmac |
| |
|
|
Rc4HmacExp |
| |
|
|
Aes128CtsHmacSha1_96 |
| |
|
|
Aes256CtsHmacSha1_96 |
| |
|
|
DsaWithSha1 |
| |
|
|
Md5WithRsa |
| |
|
|
Sha1WithRsa |
| |
|
|
Rc2Cbc |
| |
|
|
Rsa |
| |
|
|
RsaesOaep |
| |
|
|
DesEde3Cbc |
| -TicketKey |
|
<HexString> |
Key to encrypt ticket with |
| -UserDomain |
|
<String> |
Logon domain (NetBIOS) of the user |
| -UserName |
|
<UserPrincipalName> |
User name |
| -UserRealm |
|
<String> |
Logon domain (FQDN) of the user |
| -UserSid |
|
<SecurityIdentifier> |
User SID |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -W, -Workstation |
|
<String> |
Name of client workstation |
Output
| Name |
Aliases |
Value |
Description |
| -A, -Append |
|
<SwitchParam> |
Appends to the output file, if it exists |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -OutputFileName |
|
<String> |
Name of file to write ticket to |
| -Overwrite |
|
<SwitchParam> |
Overwrites the output file, if it exists |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
The forged ticket includes a PAC signed with
Kerb getasinfo
Gets server time and encryption types (with salts) for a user account.
Synopsis
Kerb getasinfo [options] <UserName> <Kdc>
Parameters
| Name |
Aliases |
Value |
Description |
| <UserName> |
|
<UserPrincipalName> |
Name of user (no domain) |
| <Kdc> |
|
<String> |
Host name or address of KDC |
Options
| Name |
Aliases |
Value |
Description |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -E, -EncTypes |
|
<EType[]> |
ETypes to request |
| |
|
|
Possible values: |
| |
|
|
DesCbcMd5 |
| |
|
|
DesCbcCrc |
| |
|
|
Rc4Hmac |
| |
|
|
Rc4HmacExp |
| |
|
|
Aes128CtsHmacSha1_96 |
| |
|
|
Aes256CtsHmacSha1_96 |
| |
|
|
DsaWithSha1 |
| |
|
|
Md5WithRsa |
| |
|
|
Sha1WithRsa |
| |
|
|
Rc2Cbc |
| |
|
|
Rsa |
| |
|
|
RsaesOaep |
| |
|
|
DesEde3Cbc |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
EType |
| |
|
|
SaltText |
| |
|
|
SaltHex |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -S, -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -R, -Realm |
|
<String> |
Name of realm (domain) |
Connection
| Name |
Aliases |
Value |
Description |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
This command sends an AS-REQ to the KDC for a user and checks the response.
Typically, the KDC response with an error indicating that preauthentication is
required along with its time and valid encryption wypes for the specified
account. This command analyzes that error response and prints the information.
If the account does not exist or the realm name is wrong, the KDC returns an
error indicating this and does not provide preauthentication info.
If the user exists but does not require preauthentication, the KDC will instead
reply with a TGT without providing encryption types. In that case, use the
requesttgt command to analyze the ticket.
Examples
Example 1 - Get AS info for milchick
Kerb getasinfo milchick@LUMON 10.66.0.11
Kerb keytab
Display and edit keytab files
Synopsis
Subcommands
| Command |
Description |
| list |
Lists the entries in a keytab file |
For help on a subcommand, use Kerb keytab <subcommand> -h
Kerb renew
Renews a ticket
Synopsis
Kerb renew [options] <Kdc> [ <TargetSpn> ]
Parameters
| Name |
Aliases |
Value |
Description |
| <Kdc> |
|
<EndPoint> |
Host name or address of KDC |
| -TargetSpn |
|
<SecurityPrincipalName[]> |
SPNs to renew tickets for |
Options
| Name |
Aliases |
Value |
Description |
| -ArmorTicket |
|
<String> |
Name of file containing armor ticket |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -S, -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -TicketComment |
|
<String> |
Comment to associate with ticket |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -E, -EndTime |
|
<DateTime> |
End time |
| -F, -Forwardable |
|
<SwitchParam> |
Requests a forwardable ticket |
| -Postdate |
|
<DateTime> |
Requests a postdated ticket with the specified start date |
| -Proxiable |
|
<SwitchParam> |
Requests a forwardable ticket |
| -Renewable |
|
<SwitchParam> |
Requests a renewable ticket |
| -RenewableOk |
|
<SwitchParam> |
Accepts a renewable ticket if the end time is over the limit |
| -RenewTill |
|
<DateTime> |
Requests a ticket renewable until the specified time (implies -Renewable) |
| -TargetSpn |
|
<SecurityPrincipalName[]> |
SPNs to renew tickets for |
| -Ticket |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -W, -Workstation |
|
<String> |
Name of client workstation |
Connection
| Name |
Aliases |
Value |
Description |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -Append |
|
<SwitchParam> |
Appends to the output file, if it exists |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -OutputFileName |
|
<String> |
Name of file to write ticket to |
| -Overwrite |
|
<SwitchParam> |
Overwrites the output file, if it exists |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
This command sends a request to the TGS to renew the source ticket. You may
provide the source ticket to renew either with -Ticket or -TicketCache. For
-TicketCache, -TargetSpn is required; for -Ticket, -TargetSpn is optional. If
you specify both -Ticket and -TicketCache, Kerb renew only loads source tickets
from -Ticket and only uses -TicketCache for output.
If you specify -TargetSpn with one or more SPNs, Kerb renew only renews tickets
matching one of the specified SPNs.
Examples
Example 1 - Renewing all tickets in a file
Kerb renew -Ticket milchick-lumon-fs1.kirbi 10.66.0.11 -OutputFileName milchick-lumon-fs1.kirbi -Overwrite
Example 2 - Renewing tickets from cache
Kerb renew -TicketCache milchick.ccache 10.66.0.11 -TargetSpn host/lumon-fs1, cifs/lumon-fs1
Kerb s2k
Generates a protocol key from a string, such as a password
Synopsis
Kerb s2k [options] <Password> [ <Salt> ] [ <EncType> ]
Parameters
| Name |
Aliases |
Value |
Description |
| <Password> |
|
<String> |
String, such as the password |
| -S, -Salt |
|
<String> |
Salt as a string |
| -E, -EncType |
|
<EType[]> |
Encryption types to generate for |
| |
|
|
Possible values: |
| |
|
|
DesCbcMd5 |
| |
|
|
DesCbcCrc |
| |
|
|
Rc4Hmac |
| |
|
|
Rc4HmacExp |
| |
|
|
Aes128CtsHmacSha1_96 |
| |
|
|
Aes256CtsHmacSha1_96 |
| |
|
|
DsaWithSha1 |
| |
|
|
Md5WithRsa |
| |
|
|
Sha1WithRsa |
| |
|
|
Rc2Cbc |
| |
|
|
Rsa |
| |
|
|
RsaesOaep |
| |
|
|
DesEde3Cbc |
Options
| Name |
Aliases |
Value |
Description |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -ContinueOnError |
|
<SwitchParam> |
Continue even if errors occur |
| -E, -EncType |
|
<EType[]> |
Encryption types to generate for |
| |
|
|
Possible values: |
| |
|
|
DesCbcMd5 |
| |
|
|
DesCbcCrc |
| |
|
|
Rc4Hmac |
| |
|
|
Rc4HmacExp |
| |
|
|
Aes128CtsHmacSha1_96 |
| |
|
|
Aes256CtsHmacSha1_96 |
| |
|
|
DsaWithSha1 |
| |
|
|
Md5WithRsa |
| |
|
|
Sha1WithRsa |
| |
|
|
Rc2Cbc |
| |
|
|
Rsa |
| |
|
|
RsaesOaep |
| |
|
|
DesEde3Cbc |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
EType |
| |
|
|
KeyText |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -S, -Salt |
|
<String> |
Salt as a string |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -H, -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
When authenticating with a password, Kerberos internally generates a protocol
key from the password and the accompanying salt using the String-to-key
function defined for each encryption profile. For Windows domains, the salt
for a user account is usually the FQDN of the domain in uppercase followed by
the account name. Specifically, the salt is composed of the domain and SAM
account name at the time of the last password is changed. Therefore, if an
account has been renamed, the salt retains the old account name until the user
changes the password again.
NOTE: Be sure to read the above regarding salts. Using the wrong salt has the
same effect as using the wrong password and may result in account lockout.
You may use Kerb getasinfo to get the salt for an account.
For more details, see [MS-KILE] § 3.1.1.2
The domain name used for the salt must be the FQDN of the domain, not the
shorter NetBIOS name.
Examples
Example 1 - Generate keys for milchick in domain LUMON.IND
Kerb s2k Br3@kr00m! LUMON.INDseth
Example 2 - Generate AES keys for milchick in domain LUMON.IND
Kerb s2k Br3@kr00m! LUMON.INDseth -EncType Aes128CtsHmacSha1_96, Aes256CtsHmacSha1_96
Example 3 - Generate keys for computer ALLENTOWN$ in domain LUMON.IND
Kerb s2k password LUMON.INDhostallentown.lumon.ind
Kerb select
Selects and displays tickets from a file.
Synopsis
Kerb select [options] [ <From> ]
Parameters
| Name |
Aliases |
Value |
Description |
| <From> |
|
<String[]> |
File names or patterns |
Options
| Name |
Aliases |
Value |
Description |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
SourceFileName |
| |
|
|
SeqNbr |
| |
|
|
Comment |
| |
|
|
ClientName |
| |
|
|
ClientRealm |
| |
|
|
TicketRealm |
| |
|
|
TargetSpn |
| |
|
|
ServiceClass |
| |
|
|
ServiceInstance |
| |
|
|
ServiceRealm |
| |
|
|
KdcOptions |
| |
|
|
EndTime |
| |
|
|
StartTime |
| |
|
|
RenewTill |
| |
|
|
AsrepKeyText |
| |
|
|
TicketKeyText |
| |
|
|
SupportedEncryptionTypes |
| |
|
|
SessionEType |
| |
|
|
SessionKeyText |
| |
|
|
TicketEType |
| |
|
|
TgsrepHashcatMethod |
| |
|
|
TicketHash |
| |
|
|
IsCurrent |
| |
|
|
CachedAuthData |
| |
|
|
SecurityGroups |
| |
|
|
NtlmHashText |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -H, -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -Into |
|
<String> |
Target file name |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Overwrite |
|
<SwitchParam> |
Overwrites target file if it exists |
| -P, -PrintAuthData |
|
<SwitchParam> |
Prints ticket authorization data (if decrypted) |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Ticket Decryption
| Name |
Aliases |
Value |
Description |
| -ServicePassword |
|
<String[]> |
Password for service account |
| -ServiceSalt |
|
<String[]> |
Salt for service account |
| -TicketKey |
|
<HexString[]> |
Key to decrypt the ticket |
Ticket Filter
| Name |
Aliases |
Value |
Description |
| -Current |
|
<SwitchParam> |
Only select tickets currently valid |
| -InvertMatch |
|
<SwitchParam> |
Invert match; select whatever doesn’t match |
| -MatchingClientName |
|
<String[]> |
Regex of client name to match |
| -MatchingSessionEType |
|
<EType[]> |
Filter for session key encryption type |
| |
|
|
Possible values: |
| |
|
|
DesCbcMd5 |
| |
|
|
DesCbcCrc |
| |
|
|
Rc4Hmac |
| |
|
|
Rc4HmacExp |
| |
|
|
Aes128CtsHmacSha1_96 |
| |
|
|
Aes256CtsHmacSha1_96 |
| |
|
|
DsaWithSha1 |
| |
|
|
Md5WithRsa |
| |
|
|
Sha1WithRsa |
| |
|
|
Rc2Cbc |
| |
|
|
Rsa |
| |
|
|
RsaesOaep |
| |
|
|
DesEde3Cbc |
| -MatchingSpn |
|
<String[]> |
Regex of SPN to match |
| -MatchingTicketEType |
|
<EType[]> |
Filter for ticket encryption type |
| |
|
|
Possible values: |
| |
|
|
DesCbcMd5 |
| |
|
|
DesCbcCrc |
| |
|
|
Rc4Hmac |
| |
|
|
Rc4HmacExp |
| |
|
|
Aes128CtsHmacSha1_96 |
| |
|
|
Aes256CtsHmacSha1_96 |
| |
|
|
DsaWithSha1 |
| |
|
|
Md5WithRsa |
| |
|
|
Sha1WithRsa |
| |
|
|
Rc2Cbc |
| |
|
|
Rsa |
| |
|
|
RsaesOaep |
| |
|
|
DesEde3Cbc |
| -SeqNbr |
|
<NumberOrRange[]> |
Seq. nbr. or range |
Ticket Source
| Name |
Aliases |
Value |
Description |
| -TicketCache |
|
<String> |
Name of ticket cache file |
Details
This command reads tickets from one or more files (.kirbi or .ccache),
optionally filters them, and optionally writes the results to another file
(either .kirbi or .ccache). It can be used to inspect files, convert files,
combine files, or remove tickets from files.
The command accepts both -TicketCache and -From to specify one or more files to
read tickets from. If -From is specified, -TicketCache is ignored. This is to
facilitate the use of $KRB5CCNAME. If this environment variable is set, you
don’t need to specify -From. If you specify -From, this expresses your desire
to ignore the ticket cache.
Specify the source files using -From. You may specify multiple files and
multiple wildcard patterns. Kerb select reads all files from the tickets and
applies any filters specified before printing the tickets to the screen. If
you specify -Into, the results are written to the file you specify. Use
-Overwrite to overwrite the outptu file if it already exists.
Examples
Example 1 - Print tickets from all mlichick*.ccache files
Kerb select -From milchick*.ccache
Example 2 - Combine tickets from all mlichick*.kirbi files
Kerb select -From milchick*.ccache -Into all-milchick.ccache
Example 3 - Print only current tickets from all mlichick*.kirbi files
Kerb select -From milchick*.kirbi -Current
Example 4 - Print only TGTs
Kerb select -From milchick*.kirbi -MatchingSpn krbtgt/.*
Example 5 - Print only tickets for CIFS
Kerb select -From milchick*.kirbi -MatchingSpn cifs/.*
Example 6 - Print only tickets targeting LUMON-FS1
Kerb select -From milchick*.kirbi -MatchingSpn .*/LUMON-FS1
Example 7 - Print only tickets #1, 3-5, 7+
Kerb select -From milchick*.kirbi -SeqNbr 1, 3-5, 7-*
Kerb setpw
Sets the password of (another) account
Synopsis
Kerb setpw [options] <TargetAccount> <NewPassword>
Parameters
| Name |
Aliases |
Value |
Description |
| <TargetAccount> |
|
<UserPrincipalName> |
Optional name of account to set password of |
| <NewPassword> |
|
<String> |
New password to set |
Options
| Name |
Aliases |
Value |
Description |
| -AuthProxy |
|
<EndPoint> |
Endpoint of auth proxy |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Delegate |
|
<SwitchParam> |
Requests delegation (sends TGT and key for Kerberos) |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -SpnOverride |
|
<SpnMapping[]> |
Specifies an SPN override |
Authentication
| Name |
Aliases |
Value |
Description |
| -Anonymous |
|
<SwitchParam> |
Uses anonymous login |
| -NtlmHash |
|
<hexadecimal hash> |
NTLM hash for NTLM authentication |
| -Password |
-p |
<String> |
Password to authenticate with |
| -UserDomain |
-ud |
<String> |
Domain of user to authenticate with |
| -UserName |
-u |
<UserPrincipalName> |
User name to authenticate with, not including the domain |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AesKey |
|
<HexString> |
AES key (128 or 256) |
| -DelegateTicket |
|
<String[]> |
Sends the tickets (and keys) to the target for delegation |
| -DesKey |
|
<HexString> |
DES key |
| -Kdc |
|
<host-or-ip:port> |
KDC endpoint |
| -Keytab |
|
<String> |
Name of keytab file |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service to proxy through |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -Tickets |
-Ticket |
<String[]> |
Name of file containing service tickets (.kirbi or ccache) |
| -U2UserName |
|
<UserPrincipalName> |
User name to request TGT for U2U |
| -UserCert |
|
<String> |
Name of file containing user’s certificate (for PKINIT) |
| -UserKey |
|
<String> |
Name of file containing user’s key (for PKINIT) |
| -UserKeyPassword |
|
<String> |
Password to decrypt file containing user’s key (for PKINIT) |
Authentication (NTLM)
| Name |
Aliases |
Value |
Description |
| -NtlmVersion |
|
<Version> |
NTLM version number (a.b.c.d) |
| -Workstation |
-w |
<String> |
Name of workstation to send with NTLM authentication |
Connection
| Name |
Aliases |
Value |
Description |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Details
Kerb setpw uses the Windows 2000 Kerberos Change Password protocol (RFC 3244)
and can be used to change the password of a user account that may or may not be
the same as the authenticating user. This service does not require an initial
ticket and is more flexible than changepw.
Examples
Example 1 - milchick setting his own password
Kerb setpw -UserName milchick@LUMON -Kdc 10.66.0.11 -Password Br3@kr00m! milchick@lumon.ind EradicateFolly!
Example 2 - milchick setting password for marks
Kerb setpw -UserName milchick@LUMON -Kdc 10.66.0.11 -Password Br3@kr00m! marks@lumon.ind SafelySituated
Kerb tgsreq
Requests a ticket from the KDC.
Synopsis
Kerb tgsreq [options] -Target <SecurityPrincipalName[]> <Kdc> <Target>
Parameters
| Name |
Aliases |
Value |
Description |
| <Kdc> |
|
<EndPoint> |
Host name or address of KDC |
| -Target |
|
<SecurityPrincipalName[]> |
SPN(s) to request ticket(s) for |
Options
| Name |
Aliases |
Value |
Description |
| -ArmorTicket |
|
<String> |
Name of file containing armor ticket |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -Forwarded |
|
<SwitchParam> |
Requests a forwarded ticket |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
| -Realm |
|
<String> |
Realm of the KDC |
| -S4ProxyService |
|
<SecurityPrincipalName> |
Name of service account with S4U2proxy |
| -S4UserName |
|
<UserPrincipalName> |
Name of user to impersonate with S4U |
| -ServicePassword |
|
<String> |
Password for service account (for decrypting authorization data) |
| -Socks5 |
|
<host-or-ip:port> |
End point of SOCKS 5 server to use |
| -TicketComment |
|
<String> |
Comment to associate with ticket |
| -U2uTicket |
|
<String> |
Name of file containing U2U ticket |
Authentication (Kerberos)
| Name |
Aliases |
Value |
Description |
| -EncTypes |
|
<EType[]> |
Encryption types to request in response |
| |
|
|
Possible values: |
| |
|
|
DesCbcMd5 |
| |
|
|
DesCbcCrc |
| |
|
|
Rc4Hmac |
| |
|
|
Rc4HmacExp |
| |
|
|
Aes128CtsHmacSha1_96 |
| |
|
|
Aes256CtsHmacSha1_96 |
| |
|
|
DsaWithSha1 |
| |
|
|
Md5WithRsa |
| |
|
|
Sha1WithRsa |
| |
|
|
Rc2Cbc |
| |
|
|
Rsa |
| |
|
|
RsaesOaep |
| |
|
|
DesEde3Cbc |
| -EndTime |
|
<DateTime> |
End time |
| -Forwardable |
|
<SwitchParam> |
Requests a forwardable ticket |
| -Postdate |
|
<DateTime> |
Requests a postdated ticket with the specified start date |
| -Proxiable |
|
<SwitchParam> |
Requests a forwardable ticket |
| -Renewable |
|
<SwitchParam> |
Requests a renewable ticket |
| -RenewableOk |
|
<SwitchParam> |
Accepts a renewable ticket if the end time is over the limit |
| -RenewTill |
|
<DateTime> |
Requests a ticket renewable until the specified time (implies -Renewable) |
| -S4UserCert |
|
<String> |
Name of file containing a certificate of a user to impersonate with S4U |
| -Target |
|
<SecurityPrincipalName[]> |
SPN(s) to request ticket(s) for |
| -Tgt |
|
<String> |
Name of file containing a ticket-granting ticket (.kirbi or ccache) |
| -TicketCache |
|
<String> |
Name of ticket cache file |
| -W, -Workstation |
|
<String> |
Name of client workstation |
Connection
| Name |
Aliases |
Value |
Description |
| -HostAddress |
-ha |
<String[]> |
Network address(es) of the server |
| -UseTcp4Only |
-4 |
<SwitchParam> |
Only use TCP over IPv4 endpoint |
| -UseTcp6Only |
-6 |
<SwitchParam> |
Only use TCP over IPv6 endpoint |
Output
| Name |
Aliases |
Value |
Description |
| -Append |
|
<SwitchParam> |
Appends to the output file, if it exists |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -OutputFileName |
|
<String> |
Name of file to write ticket to |
| -Overwrite |
|
<SwitchParam> |
Overwrites the output file, if it exists |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |
Ticket Authorization Data (Kerberos)
| Name |
Aliases |
Value |
Description |
| -AsrepKey |
|
<HexString> |
Encryption key from AS-REP (for decryption NTLM hash) |
| -ServiceSalt |
|
<String> |
Salt for service account (for decrypting authorization data) |
Details
This command sends a TGS-REQ to the KDC to request a ticket.
The target may either be specified as a service principal name of the form
<class>/<instance> or as the name of the account itself. For machine accounts,
the $ is optional. For instance, instead of host/LUMON-FS1, you may simply use
LUMON-FS1$ or LUMON-FS1
The command line must include either a password or a hex-encoded key that is
used both for pre-authentication as well as to decrypt the response. When
specifying the NTLM hash, specify just the NTLM portion with no colon.
By default, all supported encryption types are sent in the request. To limit
this, use the -EncTypes parameter to specify which encryption types to request
from the server.
Examples
Example 1 - Requesting a ticket for SMB
Kerb tgsreq -Kdc 10.66.0.11 -Tgt milchick-tgt.kirbi cifs/LUMON-FS1 -OutputFile milchick-LUMON-FS1.kirbi
Example 2 - Requesting a ticket for LUMON-FS1
Kerb tgsreq -Kdc 10.66.0.11 -Tgt milchick-tgt.kirbi LUMON-FS1 -OutputFile milchick-LUMON-FS1.kirbi
Example 3 - Requesting a ticket for SMB and Host
Kerb tgsreq -Kdc 10.66.0.11 -Tgt milchick-tgt.kirbi cifs/LUMON-FS1, HOST/LUMON-FS1 -OutputFile milchick-LUMON-FS1.kirbi
Example 4 - Requesting a U2U ticket
Kerb tgsreq -Kdc 10.66.0.11 -v -Tgt allentown-tgt.kirbi -Overwrite -U2u allentown-tgt.kirbi -OutputFileName allentown-u2u.kirbi host/allentown
Example 5 - Requesting a U2U ticket and extracting NTLM hash
Kerb tgsreq -Kdc 10.66.0.11 -v -Tgt allentown-tgt.kirbi -Overwrite -U2u allentown-tgt.kirbi -OutputFileName allentown-u2u.kirbi host/allentown -AsrepKey 82d4ab5873cbfda126e00c28edb5bd97b6451aa06a291d85173e6fc4ed4aacee
Kerb keytab list
Lists the entries in a keytab file
Synopsis
Kerb keytab list [options] <Keytab>
Parameters
| Name |
Aliases |
Value |
Description |
| <Keytab> |
|
<String> |
Name of keytab file |
Options
| Name |
Aliases |
Value |
Description |
| -ConsoleOutputStyle |
-OutputStyle |
<OutputStyle> |
Determines the output style |
| |
|
|
Possible values: |
| |
|
|
Freeform |
| |
|
|
Raw |
| |
|
|
Table |
| |
|
|
List |
| |
|
|
Csv |
| |
|
|
Tsv |
| |
|
|
Json |
| |
|
|
TreeTable |
| -OutputFields |
|
<String[]> |
Fields to display in output |
| |
|
|
Possible values: |
| |
|
|
Principal |
| |
|
|
Realm |
| |
|
|
Timestamp |
| |
|
|
Kvno |
| |
|
|
EType |
| |
|
|
KeyText |
| -OutputHeaders |
|
<SwitchParam> |
Print headers for table/list/CSV/TSV styles |
| |
|
|
Default: True |
Output
| Name |
Aliases |
Value |
Description |
| -ConsoleLogFormat |
-LogFormat |
<LogFormat> |
Sets the format of log messages written to the console |
| |
|
|
Default: 0 |
| |
|
|
Possible values: |
| |
|
|
Text |
| |
|
|
TextWithTimestamp |
| |
|
|
Json |
| -DebugLog |
-vvv |
<SwitchParam> |
Prints debug messages |
| -Diagnostic |
-vv |
<SwitchParam> |
Prints diagnostic messages |
| -H, -HumanReadable |
|
<SwitchParam> |
Formats file sizes as human-readable values |
| -LogLevel |
|
<LogMessageSeverity> |
Sets the lowest level of messages to log |
| |
|
|
Possible values: |
| |
|
|
Debug |
| |
|
|
Diagnostic |
| |
|
|
Verbose |
| |
|
|
Info |
| |
|
|
Warning |
| |
|
|
Error |
| |
|
|
Critical |
| -Verbose |
-V |
<SwitchParam> |
Prints verbose messages |