Documentation
¶
Overview ¶
Package keytab parses an MIT Kerberos keytab file (the binary `.keytab` format, version 0x0502) into its entries — service / account principals, key-version numbers, encryption types, and the raw key bytes. A keytab recovered from a compromised host is high-value Active Directory loot: it holds the long-term Kerberos keys of the principals it serves, which an operator uses for offline ticket forging (silver tickets), pass-the-key / overpass-the-hash, and — for the RC4 (etype 23) entries — the account's NT hash directly. It is the file-format complement to kerberos_decode (which dissects the Kerberos wire protocol). Pure offline transform; no network or device.
Wrap-vs-native judgement ¶
Native. The keytab is a small, publicly documented big-endian binary format (MIT krb5 doc / source krb5_kt_*): a 2-byte version, then length-prefixed entries of counted-octet-string components + a keyblock. It is a length- prefixed walker; there is nothing to wrap, and pulling in a Kerberos library (gokrb5) — aimed at being a client — to read an untrusted file is unwarranted. Consistent with internal/kerberos and the other in-tree parsers.
Verifiable / no confidently-wrong output ¶
Anchored to the authoritative MIT `ktutil`: a keytab built per the 0x0502 spec (principal HTTP/web.example.com@EXAMPLE.COM, kvno 5, etype 18 aes256, a 32-byte key) is confirmed by `ktutil rkt … / list -e -t` to list exactly those values, and the same bytes parse to the same principal / realm / components / name-type / kvno / enctype / key here. A truncated or malformed entry is rejected with an error, deleted/hole entries (negative size) are counted and skipped, and length fields are bounds-checked. The legacy 0x0501 (host-byte-order, no name-type) variant is reported and rejected rather than guessed.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Entry ¶
type Entry struct {
Principal string `json:"principal"`
Realm string `json:"realm"`
Components []string `json:"components"`
NameType int `json:"name_type"`
NameTypeName string `json:"name_type_name,omitempty"`
TimestampUTC string `json:"timestamp_utc"`
TimestampUnix int64 `json:"timestamp_unix"`
KVNO int `json:"kvno"`
EnctypeID int `json:"enctype_id"`
EnctypeName string `json:"enctype_name,omitempty"`
KeyLength int `json:"key_length"`
KeyHex string `json:"key_hex"`
Note string `json:"note,omitempty"`
}
Entry is one keytab key entry.
type Result ¶
type Result struct {
Version string `json:"version"`
Entries []*Entry `json:"entries"`
DeletedEntries int `json:"deleted_entries,omitempty"`
TotalBytes int `json:"total_bytes"`
}
Result is the parsed keytab.
func DecodeBytes ¶
DecodeBytes parses a keytab from raw bytes.
Source Files