impacket-gettgt

impacket-gettgt [-h] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey KEY] [-dc-ip IP] [-service SPN] target

impacket-gettgt requests a Kerberos Ticket Granting Ticket (TGT) from an Active Directory domain controller. The TGT is saved to a ccache file that can be used for subsequent Kerberos authentication with other tools.This tool is useful for obtaining Kerberos tickets when you have valid credentials (password, hash, or AES key) and need to authenticate to Kerberos-enabled services. The resulting ccache file can be exported via the KRB5CCNAME environment variable.

-hashes LMHASH:NTHASH

Use NTLM hashes for authentication instead of password.

Don't ask for password (useful together with -k).

Use Kerberos authentication; grab credentials from ccache file (KRB5CCNAME).

AES key to use for Kerberos authentication (128 or 256 bit).

IP address of the domain controller (KDC). If omitted, the domain part of the identity is used.

Request a service ticket directly through an AS-REQ for the given SPN.

Principal name type (default NT_PRINCIPAL).

Enable debug output.

Requires valid domain credentials in some form (password, NTLM hash, or AES key). The domain controller must be reachable and Kerberos ports (88/tcp) must be accessible. Time synchronization between client and KDC is critical for Kerberos to function.

Part of the Impacket library by SecureAuth, implementing the Kerberos protocol for penetration testing. TGT retrieval is a fundamental operation in Kerberos-based attacks and authentication workflows.

impacket-getst(1), kinit(1), impacket-secretsdump(1)