KerbDump
Runs Kirby to dump kerberos tickets on the remote system. Kirby is based on PowerShellKerberos by Michael Zhmaylo (MzHmO): https://github.com/MzHmO/PowershellKerberos
For each system output is stored in $pwd\PME\Tickets\KerbDump\
Supported Methods
MSSQL
SMB
SessionHunter (WMI)
WMI
WinRM
Optional Parameters
Usage
Parsing
If -NoParse
is not specified, PsMapExec will parse the results from each system and present the results in a digestable and readable format. The notes field will highlight in yellow any interesting information about each result.
Tickets identified as a TGT will also show an easy command to execute directly after with PsMapExec to impersonate that account within the Impersonate field.
The table below shows the possible values for the notes field.
Last updated