Skip to content

getST

Description

Given a password, hash, aesKey or TGT in ccache, it will request a Service Ticket and save it as ccache. If the account has constrained delegation (with protocol transition) privileges you will be able to use the -impersonate switch to request the ticket on behalf other user (it will use S4U2Self/S4U2Proxy to request the ticket.)

Usage

getST.py -spn WWW/dc.qu35t.pw -impersonate Administrator qu35t.pw/svc_user:password

TODO

Authentication

TODO

References