> For the complete documentation index, see [llms.txt](https://www.impacket.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.impacket.wiki/how-to-guides/kerberos-tickets-flow.md).

# Using Kerberos Tickets In impacket

You have a Kerberos ticket from Impacket, Rubeus, `kinit`, or another tool, and need to authenticate with it across different Impacket protocols.

## What you need

* A `.ccache` file containing a TGT or service tickets
* DNS resolution for target hostnames (Kerberos requires hostnames, not IPs)

***

## Set the ccache environment variable

All Impacket Kerberos authentication reads from this:

```python
import os
os.environ['KRB5CCNAME'] = '/path/to/ticket.ccache'
```

***

## Convert tickets from other tools

### From Rubeus (.kirbi base64)

```python
import base64
from impacket.krb5.ccache import CCache

kirbi_b64 = "doIF..."  # base64 from Rubeus output
kirbi_bytes = base64.b64decode(kirbi_b64)

ccache = CCache()
ccache.fromKRBCRED(kirbi_bytes)
ccache.saveFile('converted.ccache')
os.environ['KRB5CCNAME'] = 'converted.ccache'
```

### From a .kirbi file on disk

```python
with open('ticket.kirbi', 'rb') as f:
    kirbi_bytes = f.read()

ccache = CCache()
ccache.fromKRBCRED(kirbi_bytes)
ccache.saveFile('converted.ccache')
```

### Export from Impacket back to .kirbi (for use with Rubeus)

```python
ccache = CCache.loadFile('ticket.ccache')
kirbi_data = ccache.toKRBCRED()

with open('ticket.kirbi', 'wb') as f:
    f.write(kirbi_data)

# Or base64 for Rubeus import
print(base64.b64encode(kirbi_data).decode())
```

***

## Authenticate across protocols

### SMBConnection

```python
from impacket.smbconnection import SMBConnection

conn = SMBConnection(target_hostname, target_ip)
conn.kerberosLogin(user='', password='', domain=domain, kdcHost=dc_ip, useCache=True)
```

### LDAPConnection

```python
from impacket.ldap import ldap as ldap_impacket

ldap_conn = ldap_impacket.LDAPConnection(url=f"ldap://{target_hostname}", baseDN=base_dn)
ldap_conn.kerberosLogin(user='', password='', domain=domain, kdcHost=dc_ip, useCache=True)
```

### DCE/RPC transports

```python
from impacket.dcerpc.v5 import transport, scmr

rpctransport = transport.DCERPCTransportFactory(rf'ncacn_np:{target_hostname}[\pipe\svcctl]')
rpctransport.set_credentials('', '', domain)
rpctransport.set_kerberos(True, dc_ip)

dce = rpctransport.get_dce_rpc()
dce.connect()
dce.bind(scmr.MSRPC_UUID_SCMR)
```

### MSSQL

```python
from impacket import tds

client = tds.MSSQL(target_hostname, 1433)
client.connect()
client.kerberosLogin(database=None, username='', password='', domain=domain, kdcHost=dc_ip, useCache=True)
```

### WMI/DCOM

```python
from impacket.dcerpc.v5.dcomrt import DCOMConnection

dcom = DCOMConnection(target_hostname, username='', password='', domain=domain,
                      doKerberos=True, kdcHost=dc_ip)
```

***

## Request service tickets for specific SPNs

If your ccache has a TGT but not the service ticket you need:

```python
from impacket.krb5.kerberosv5 import getKerberosTGS
from impacket.krb5.types import Principal
from impacket.krb5 import constants
from impacket.krb5.ccache import CCache

ccache = CCache.loadFile('ticket.ccache')
tgt = ccache.credentials[0].toTGT()

# Request a TGS for a specific SPN
spn = f"MSSQLSvc/{target_hostname}:1433"
server_name = Principal(spn, type=constants.PrincipalNameType.NT_SRV_INST.value)

tgs, cipher, _, session_key = getKerberosTGS(
    serverName=server_name, domain=domain, kdcHost=dc_ip,
    tgt=tgt['KDC_REP'], cipher=tgt['cipher'], sessionKey=tgt['sessionKey'],
)

# Save the TGS to the ccache
ccache.fromTGS(tgs, _, session_key)
ccache.saveFile('ticket.ccache')
```

Common SPNs:

```
cifs/hostname          — SMB file access
ldap/hostname          — LDAP queries
MSSQLSvc/hostname:1433 — SQL Server
HTTP/hostname          — Web services, ADCS
HOST/hostname          — General host services
```

***

## Use a TGT to request S4U2Self tickets (impersonation)

If you have a machine account's TGT and the target is configured for delegation:

```python
from impacket.krb5.kerberosv5 import getKerberosTGS
from impacket.krb5 import constants

# S4U2Self: request a ticket to yourself on behalf of another user
# This requires the machine account to have delegation privileges

# First, request a TGS to your own SPN as the target user
# The S4U2Self extension is handled by Impacket's getKerberosTGS
# with the appropriate flags
```

***

## Inspect a ccache file

```python
ccache = CCache.loadFile('ticket.ccache')
print(f"Principal: {ccache.principal}")
print(f"Credentials: {len(ccache.credentials)}")

for cred in ccache.credentials:
    server = cred['server']
    times = cred['time']
    print(f"  Server: {server}")
    print(f"  Auth time: {times['authtime']}")
    print(f"  End time: {times['endtime']}")
```

***

## Common issues

* **Target must be a hostname**, not an IP. Kerberos validates the SPN against the ticket.
* **Clock skew**: Kerberos requires clocks within 5 minutes. Sync with `ntpdate` if needed.
* **Ticket expired**: check `endtime` in the ccache. Request a fresh TGT if expired.
* **Wrong SPN**: `cifs/` for SMB, `ldap/` for LDAP, `MSSQLSvc/` for SQL. A `cifs/` ticket won't work for LDAP.
* **DNS**: the hostname must resolve to the target IP. Add entries to `/etc/hosts` if DNS isn't configured.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.impacket.wiki/how-to-guides/kerberos-tickets-flow.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.