keytabextract.py $USER.keytab

• Linux
• oscp
• cli
• Kerberos
• CredAccess

Pull the realm, service principal, and NTLM hash out of a captured Kerberos keytab

Command: copy

References:

Related commands

• auth_ldap $IP $USER -p $PASSWORD $DOMAIN [-ldap|-ldaps]
• certipy find -dc-ip $DCIP -u $USER@$DOMAIN -p $PASSWORD -vulnerable...
• crunch 1 1 -f fullnames.txt -t ,@^ -o usernames.txt 1
• donpapi collect -u $USER -p $PASSWORD -d $DOMAIN --dc-ip $DCIP -t ALL
• export KRB5CCNAME=out.ccache uv run getnthash.py -key $ASREPKEY $DO...
• uv run gettgtpkinit.py $DOMAIN/$DC -cert-pfx crt.pfx -pfx-pass $PAS...