getPac

Description

This script will get the PAC of the specified target user just having a normal authenticated user credentials. It does so by using a mix of [MS-SFU]'s S4USelf + User to User Kerberos Authentication.

Usage

Retrieve a target's PACRetrieve the current user's PAC

getPac.py -target administrator qu35t.pw/svc_user:password

getPac.py qu35t.pw/svc_user:password

Authentication

NTLM hashes

getPac.py -hashes LMHASH:NTHASH qu35t.pw/svc_user

References

• Impacket Github
• Ippsec - Scrambled