gettgt.py

getTGT.py domain/user[:password] [options]

getTGT.py is an Impacket example script that requests a Kerberos Ticket Granting Ticket (TGT) from an Active Directory domain controller, given a password, an NTLM hash, or an AES key. The official description reads: "Given a password, hash or aesKey, it will request a TGT and save it as ccache."The resulting ticket is written to a ccache file named after the principal (for example `username.ccache`). Set the KRB5CCNAME environment variable to that file and other Impacket tools, or native utilities, can reuse the ticket for pass-the-ticket authentication.There is no dedicated output flag: the ccache filename is derived from the username automatically.

DOMAIN/USER[:PASSWORD]

Target identity. The password is optional and is prompted for if omitted.

IP address of the domain controller. Defaults to the domain FQDN if omitted.

NTLM hashes to authenticate with. The LM half may be left empty (`:NTHASH`).

AES key (128 or 256 bit) for Kerberos authentication.

Use Kerberos credentials from the ccache file (KRB5CCNAME), falling back to the supplied credentials.

Do not prompt for a password, useful together with -k.

Turn on DEBUG output.

Add a timestamp to each log line.

Authorized testing only. Requires valid credentials and clock sync with the domain controller, since large time skew breaks Kerberos. Tickets have a limited lifetime.

getTGT.py is part of Impacket, the Python network protocol toolkit for Active Directory security testing, originally by Core Security and now maintained by Fortra.

getuserspns.py(1), kerberos(7), kinit(1)