Documentation
¶
Overview ¶
Package ccache parses an MIT Kerberos credential cache (the binary FILE: ccache format, version 0x0504) into its default principal and stored credentials — the client / server principals, ticket flags, validity times, session key, and the embedded ticket bytes. A ccache lifted from a host (the on-disk /tmp/krb5cc_* / KRB5CCNAME file, or a Rubeus / Mimikatz dump) is high-value Active Directory loot: it holds live Kerberos tickets usable for **pass-the-ticket**, and a TGT (service krbtgt/…) is the golden-ticket / delegation pivot. It is the credential-cache complement to keytab_decode (long-term keys) and kerberos_decode (the wire protocol). Pure offline transform; no network or device.
Wrap-vs-native judgement ¶
Native. The ccache is a documented big-endian length-prefixed binary format (MIT krb5 ccache_file_format): a 2-byte version, a tagged header, a default principal, then variable-length credentials of uint32-counted principals + keyblock + times + flags + addresses + authdata + ticket. It is a length-prefixed walker; there is nothing to wrap, and pulling in a Kerberos library to read an untrusted file is unwarranted. Consistent with internal/keytab and internal/kerberos owning their parse in-tree.
Verifiable / no confidently-wrong output ¶
Anchored to the authoritative MIT `klist`: a ccache built per the 0x0504 spec (default principal alice@EXAMPLE.COM, a credential for krbtgt/EXAMPLE.COM with times + ticket_flags 0x40e00000) is confirmed by `klist -cf` to list exactly that principal, service, the three times, and `Flags: FRIA` (Forwardable/Renewable/Initial/preAuth) — and the same bytes parse to the same values here. Length fields are bounds-checked, hostile counts are capped, and a truncated/malformed credential is rejected. The legacy 0x0501–0x0503 variants (different header / byte-order) are reported and rejected rather than guessed.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Credential ¶
type Credential struct {
Client string `json:"client"`
Server string `json:"server"`
KeyType int `json:"key_type"`
KeyTypeName string `json:"key_type_name,omitempty"`
KeyHex string `json:"key_hex"`
AuthTimeUTC string `json:"auth_time_utc,omitempty"`
StartTimeUTC string `json:"start_time_utc,omitempty"`
EndTimeUTC string `json:"end_time_utc,omitempty"`
RenewTillUTC string `json:"renew_till_utc,omitempty"`
TicketFlags uint32 `json:"ticket_flags"`
TicketFlagNames []string `json:"ticket_flag_names,omitempty"`
IsSkey bool `json:"is_skey"`
TicketLength int `json:"ticket_length"`
TicketHex string `json:"ticket_hex"`
SecondTicketLength int `json:"second_ticket_length,omitempty"`
// InnerTicket is the decoded cleartext outer structure of the embedded
// [APPLICATION 1] Ticket (service principal + enc-part etype), when it
// is a well-formed Ticket DER.
InnerTicket *kerberos.TicketInfo `json:"inner_ticket,omitempty"`
Note string `json:"note,omitempty"`
}
Credential is one cached ticket + its metadata.
type Result ¶
type Result struct {
Version string `json:"version"`
DefaultPrincipal string `json:"default_principal"`
Credentials []*Credential `json:"credentials"`
TotalBytes int `json:"total_bytes"`
}
Result is the parsed credential cache.
func DecodeBytes ¶
DecodeBytes parses a credential cache from raw bytes.
Source Files