Overview
Parse and display detailed information about Kerberos tickets. This command analyzes ticket structure, encryption details, service information, and validity periods for both TGTs and service tickets.Syntax
Required Parameters
Base64-encoded ticket data or path to .kirbi file to analyze
Optional Parameters
Service key to decrypt ticket (RC4/AES128/AES256)
KRB-CRED key to decrypt tickets
AS-REP key for decrypting AS-REP tickets
Examples
Ticket Information
Basic Ticket Details
Basic Ticket Details
Structure Information:
- Ticket version and message type
- Encryption algorithm used
- Service principal name (SPN)
- Client principal name
- Start time (authtime)
- End time (endtime)
- Renew-till time (if renewable)
- Current validity status
Flags and Attributes
Flags and Attributes
Ticket Flags:
- Forwardable, Forwarded
- Proxiable, Proxy
- Renewable, Initial
- Pre-authent, HW-authent
- Transited-policy-checked
- Encryption type details
- Key version number (kvno)
- Authorization data presence
- Delegation information
Use Cases
Ticket Validation
Ticket Validation
Pre-Injection Analysis:
- Verify ticket validity before PTT
- Check encryption compatibility
- Validate service targeting
- Confirm expiration status
- Identify forged vs legitimate tickets
- Check for proper flag settings
- Validate encryption strength
- Assess operational security
Forensic Analysis
Forensic Analysis
Incident Response:
- Analyze suspicious tickets
- Identify attack indicators
- Trace ticket origins
- Document evidence details
- Understand ticket structure
- Analyze custom implementations
- Debug authentication issues
- Research new techniques
Decryption Capabilities
Service Key Decryption
Service Key Decryption
When Available:
- Service account password/hash known
- Machine account credentials obtained
- Service key extracted from memory
- Encrypted ticket portion contents
- Authorization data details
- Session key information
- Extended attributes
KRB-CRED Analysis
KRB-CRED Analysis
Credential Structures:
- Multiple ticket analysis
- Session key extraction
- Credential forwarding data
- Delegation chain information
- Cross-realm ticket analysis
- Trust relationship validation
- Complex delegation scenarios
- Multi-hop authentication
Output Analysis
Understanding Output
Understanding Output
Key Information:Critical Fields:
- Service targeting accuracy
- Validity window analysis
- Encryption strength assessment
- Flag configuration review
Integration Workflows
Pre-Attack Analysis
Pre-Attack Analysis
Ticket Preparation:
Post-Forgery Verification
Post-Forgery Verification
Quality Control: