ccache to kirbi file parser for Linux about mimikatz

[jun0s]

https://github.com/rvazarkar/KrbCredExport

[gentilkiwi]

If you read Python (not like me ;)), please, take a look at @jun0s link.

In all case, no magical tricks in tools, all is based on:

• https://www.gnu.org/software/shishi/manual/html_node/The-Credential-Cache-Binary-File-Format.html
• https://tools.ietf.org/html/rfc1510#section-5.8.1

With a little bit of ASN.1 inside ;)

Otherwise, you can have a look inside kekeo, especially the kirbikator project : https://github.com/gentilkiwi/kekeo/tree/master/kirbikator
Its goal is to convert from everything, to everything... (convert, split, merge, etc... from different formats).

More understandable than mimikatz because kekeo uses small code dedicated to Kerberos.

[jun0s]

I forgot kekeo -.-´ but he say "under linux"

[gentilkiwi]

I only mention it because of the code ;)

[Thanathan-k]

Thank you guys! I'll have a look at the python project, as well as the provided links to get some more understanding of the topic :)

Edit: Okay KrbCredExport works, but tgsrepcrack from Kerberoast is unable to crack the file. Even though it's detected as ticket. Maybe I need to split the output into the TGT and Service tickets. I'll have a look into that.

Edit2: Okay KrbCredExport only took the first credential. A simple while loop fixed it. Now it works. Thanks guys! I may commit the change to KrbCredExport.