mirror of
https://github.com/fortra/impacket
synced 2026-06-08 14:15:13 +00:00
Adham Elmosalamy
8cb82c0fdf
* feat: added --base64 option to ticketConverter * Cleanup manually to avoid issues with Windows delete permissions
114 lines
3.3 KiB
Python
Executable File
114 lines
3.3 KiB
Python
Executable File
#!/usr/bin/env python
|
|
# Impacket - Collection of Python classes for working with network protocols.
|
|
#
|
|
# Copyright Fortra, LLC and its affiliated companies
|
|
#
|
|
# All rights reserved.
|
|
#
|
|
# This software is provided under a slightly modified version
|
|
# of the Apache Software License. See the accompanying LICENSE file
|
|
# for more information.
|
|
#
|
|
# Description:
|
|
# This script will convert kirbi files (commonly used by mimikatz) into ccache files used by impacket,
|
|
# and vice versa.
|
|
#
|
|
# Examples:
|
|
# ./ticket_converter.py admin.ccache admin.kirbi
|
|
# ./ticket_converter.py admin.kirbi admin.ccache
|
|
#
|
|
# Author:
|
|
# Zer1t0 (https://github.com/Zer1t0)
|
|
#
|
|
# References:
|
|
# - https://tools.ietf.org/html/rfc4120
|
|
# - http://web.mit.edu/KERBEROS/krb5-devel/doc/formats/ccache_file_format.html
|
|
# - https://github.com/gentilkiwi/kekeo
|
|
# - https://github.com/rvazarkar/KrbCredExport
|
|
#
|
|
|
|
import os
|
|
import argparse
|
|
import base64
|
|
import struct
|
|
import tempfile
|
|
|
|
from impacket import version
|
|
from impacket.krb5.ccache import CCache
|
|
|
|
|
|
def parse_args():
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument('input_file', help="File in kirbi (KRB-CRED) or ccache format")
|
|
parser.add_argument('output_file', help="Output file")
|
|
parser.add_argument(
|
|
'-b', '--base64', action='store_true', help="Decode input ticket from base64 with unwrap support"
|
|
)
|
|
return parser.parse_args()
|
|
|
|
|
|
def main():
|
|
print(version.BANNER)
|
|
|
|
args = parse_args()
|
|
|
|
if args.base64:
|
|
decoded_file = tempfile.NamedTemporaryFile(mode='w+b', delete=False)
|
|
print('[*] base64 decoding ticket')
|
|
decoded_file.write(base64_decode_with_unwrap(args.input_file))
|
|
decoded_file.flush()
|
|
|
|
input_file = decoded_file.name if args.base64 else args.input_file
|
|
|
|
if is_kirbi_file(input_file):
|
|
print('[*] converting kirbi to ccache...')
|
|
convert_kirbi_to_ccache(input_file, args.output_file)
|
|
print('[+] done')
|
|
elif is_ccache_file(input_file):
|
|
print('[*] converting ccache to kirbi...')
|
|
convert_ccache_to_kirbi(input_file, args.output_file)
|
|
print('[+] done')
|
|
else:
|
|
print('[X] unknown file format')
|
|
|
|
# Cleanup manually to avoid issues with Windows delete permissions
|
|
if args.base64:
|
|
try:
|
|
decoded_file.close()
|
|
os.unlink(decoded_file.name)
|
|
except PermissionError:
|
|
print('[!] Failed to clean temporary files due to PermissionError')
|
|
|
|
|
|
def is_kirbi_file(filename):
|
|
with open(filename, 'rb') as fi:
|
|
fileid = struct.unpack(">B", fi.read(1))[0]
|
|
return fileid == 0x76
|
|
|
|
|
|
def is_ccache_file(filename):
|
|
with open(filename, 'rb') as fi:
|
|
fileid = struct.unpack(">B", fi.read(1))[0]
|
|
return fileid == 0x5
|
|
|
|
|
|
def convert_kirbi_to_ccache(input_filename, output_filename):
|
|
ccache = CCache.loadKirbiFile(input_filename)
|
|
ccache.saveFile(output_filename)
|
|
|
|
|
|
def convert_ccache_to_kirbi(input_filename, output_filename):
|
|
ccache = CCache.loadFile(input_filename)
|
|
ccache.saveKirbiFile(output_filename)
|
|
|
|
|
|
def base64_decode_with_unwrap(input_filename):
|
|
with open(input_filename, 'r', encoding='latin-1') as f:
|
|
data = ''.join(f.read().strip().splitlines())
|
|
data = base64.b64decode(data.encode('latin-1'))
|
|
|
|
return data
|
|
|
|
if __name__ == '__main__':
|
|
main()
|