impacket/examples/ticketConverter.py at master · synacktiv/impacket · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
#!/usr/bin/env python
# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright Fortra, LLC and its affiliated companies
#
# All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
#   This script will convert kirbi files (commonly used by mimikatz) into ccache files used by impacket,
#   and vice versa.
#
#   Examples:
#       ./ticket_converter.py admin.ccache admin.kirbi
#       ./ticket_converter.py admin.kirbi admin.ccache
#
# Author:
#   Zer1t0 (https://github.com/Zer1t0)
#
# References:
#   - https://tools.ietf.org/html/rfc4120
#   - http://web.mit.edu/KERBEROS/krb5-devel/doc/formats/ccache_file_format.html
#   - https://github.com/gentilkiwi/kekeo
#   - https://github.com/rvazarkar/KrbCredExport
#

import os
import argparse
import base64
import struct
import tempfile

from impacket import version
from impacket.krb5.ccache import CCache


def parse_args():
    parser = argparse.ArgumentParser()
    parser.add_argument('input_file', help="File in kirbi (KRB-CRED) or ccache format")
    parser.add_argument('output_file', help="Output file")
    parser.add_argument(
        '-b', '--base64', action='store_true', help="Decode input ticket from base64 with unwrap support"
    )
    return parser.parse_args()


def main():
    print(version.BANNER)

    args = parse_args()

    if args.base64:
        decoded_file = tempfile.NamedTemporaryFile(mode='w+b', delete=False)
        print('[*] base64 decoding ticket')
        decoded_file.write(base64_decode_with_unwrap(args.input_file))
        decoded_file.flush()

    input_file = decoded_file.name if args.base64 else args.input_file

    if is_kirbi_file(input_file):
        print('[*] converting kirbi to ccache...')
        convert_kirbi_to_ccache(input_file, args.output_file)
        print('[+] done')
    elif is_ccache_file(input_file):
        print('[*] converting ccache to kirbi...')
        convert_ccache_to_kirbi(input_file, args.output_file)
        print('[+] done')
    else:
        print('[X] unknown file format')

    # Cleanup manually to avoid issues with Windows delete permissions
    if args.base64:
        try:
            decoded_file.close()
            os.unlink(decoded_file.name)
        except PermissionError:
            print('[!] Failed to clean temporary files due to PermissionError')


def is_kirbi_file(filename):
    with open(filename, 'rb') as fi:
        fileid = struct.unpack(">B", fi.read(1))[0]
    return fileid == 0x76


def is_ccache_file(filename):
    with open(filename, 'rb') as fi:
        fileid = struct.unpack(">B", fi.read(1))[0]
    return fileid == 0x5


def convert_kirbi_to_ccache(input_filename, output_filename):
    ccache = CCache.loadKirbiFile(input_filename)
    ccache.saveFile(output_filename)


def convert_ccache_to_kirbi(input_filename, output_filename):
    ccache = CCache.loadFile(input_filename)
    ccache.saveKirbiFile(output_filename)


def base64_decode_with_unwrap(input_filename):
    with open(input_filename, 'r', encoding='latin-1') as f:
        data = ''.join(f.read().strip().splitlines())
        data = base64.b64decode(data.encode('latin-1'))

    return data

if __name__ == '__main__':
    main()