KerbDump
Last updated
Was this helpful?
Last updated
Was this helpful?
Dumps Kerberos tickets on the remote system. The code is based on PowerShell Kerberos by Michael Zhmaylo (MzHmO):
For each system output is stored in $pwd\PME\Tickets\KerbDump\
MSSQL
SMB
SessionHunter
WMI
WinRM
-NoParse
N/A
If specified, PsMapexec will not automatically parse output from all targets systems and identify accounts that belong to privileged groups.
-ShowOutput
N/A
Displays each targets output to the console
-SuccessOnly
N/A
Display only successful results
-Option
kerbdump:monitor:5
Runs on a loop on the remote host for 5 minutes collecting tickets
PsMapExec will parse the results from each system and present the results in a digestable and readable format. The notes field will highlight in yellow any interesting information about each result.
Tickets identified as a TGT will also show an easy command to execute directly after with PsMapExec to impersonate that account within the Impersonate field.
The table below shows the possible values for the notes field.
TGT
Represents a TGT ticket
AdminCount=1
Identifies an account that may hold privileged permissions within the domain
Domain Admin Enterprise Admin Server Operator Account Operator
The account is a member of one of these privileged groups