Add Kerberos trace support for forged tickets by eve0805 · Pull Request #21691 · rapid7/metasploit-framework

eve0805 · 2026-07-21T03:56:46Z

Summary

This adds KerberosTicketTrace support to the auxiliary/admin/kerberos/forge_ticket module.

The forged credential cache is rendered using the existing offline Kerberos ticket trace path introduced in #21638. This keeps forged-ticket output consistent with live Kerberos credential tracing and offline artifact inspection.

The following actions are supported:

FORGE_SILVER, rendered as FORGE_SILVER TGS
FORGE_GOLDEN, rendered as FORGE_GOLDEN TGT
FORGE_DIAMOND, rendering the final modified TGT
FORGE_SAPPHIRE, rendering the final modified TGT

Trace modes

The existing KerberosTicketTrace modes are supported:

off: preserves the existing behavior and does not print trace output.
metadata: prints high-level credential metadata without ticket cipher or key material.
ticket: prints the credential and encrypted ticket without using the forging key to decrypt the ticket.
full: uses the available NTHASH or AES key to decrypt and display the forged ticket and PAC.

The trace header includes the forge action and ticket type, for example:

####################
# Kerberos Credential: FORGE_GOLDEN TGT
####################

github-actions · 2026-07-21T03:56:54Z

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.

Pushpenderrathore · 2026-07-26T17:10:12Z

Took this for a spin in an AD lab (Server 2022 DC, real domain SID) since it's carrying additional-testing-required. It holds up, here's the full run in case it's useful for the landing.

Forged a golden ticket for Administrator (RID 500) against the lab's real domain SID and ran it through all four trace modes.

off - forges and stores, no trace output

[*] :88 - TGT MIT Credential Cache ticket saved to ...loot/...mit.kerberos.cca_365903.bin
[*] Auxiliary module execution completed

metadata - header + high-level metadata, no session key, no cipher

####################
# Kerberos Credential: FORGE_GOLDEN TGT
####################
Creds: 1
  Credential[0]:
    Server: krbtgt/KERBEROS.ISSUE@KERBEROS.ISSUE
    Client: Administrator@KERBEROS.ISSUE
    Ticket etype: 23 (RC4_HMAC)
    Subkey: false
    Ticket Length: 1042
    Ticket Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
    Times:
      Auth time: 2026-07-26 21:21:43
      End time: 2036-07-23 21:21:43

ticket - adds the session key and encrypted ticket part, but stops at the cipher without decrypting

    Key: 34303331666563346535306462366363
    ...
      Encrypted Ticket Part:
        Ticket etype: 23 (RC4_HMAC)
        Key Version Number: 2
        Cipher:

full - decrypts with the key and walks the PAC

# Kerberos Credential: FORGE_GOLDEN TGT
    Server: krbtgt/KERBEROS.ISSUE@KERBEROS.ISSUE
    Client: Administrator@KERBEROS.ISSUE
    Ticket etype: 23 (RC4_HMAC)
      Encrypted Ticket Part:
        Ticket etype: 23 (RC4_HMAC)
        Decrypted (with key: b4b9b02e6f09a9bd760f388b67351e2b):
          Client Name: 'Administrator'
          Client Realm: 'KERBEROS.ISSUE'
          Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
          PAC:
            Validation Info:
              User ID: 500
              Primary Group ID: 513
              User Account Control: 528
              Logon Domain ID: S-1-5-21-2461982042-2872582096-2145225469
              Logon Domain Name: 'KERBEROS.ISSUE'
            Pac Requestor:
            Pac Attributes:
            Pac Server Checksum:
            Pac Privilege Server Checksum:

Silver, forged with a service key, renders as FORGE_SILVER TGS

# Kerberos Credential: FORGE_SILVER TGS
    Server: cifs/dc1.kerberos.issue@KERBEROS.ISSUE
    Client: Administrator@KERBEROS.ISSUE
        Decrypted (with key: ...):
          PAC:

Specs pass (14/14), and msftidy/rubocop are clean here too.

One small thing I noticed, not sure if it's intended: in store_forged_ticket, if you set VERBOSE=true along with a trace mode that isn't full (say metadata), the key gets nulled and the ticket won't decrypt, so the trace mode ends up overriding VERBOSE. Probably the right call since the mode is the more specific setting, and VERBOSE on its own still decrypts like before. Just flagging it in case you'd want VERBOSE to keep forcing full output.

For diamond and sapphire I used a real krbtgt AES key pulled from the lab DC, since those two modify a live ticket rather than forging from scratch. Both render the same way, header plus full PAC, decrypting with the krbtgt key (redacted below). etype is AES256 here since it's a real key, rather than the RC4 above.

Diamond requests a live TGT as a low-priv user (labuser here) and re-forges it to Administrator:

FORGE_DIAMOND TGT (full mode)

####################
# Kerberos Credential: FORGE_DIAMOND TGT
####################
    Server: krbtgt/KERBEROS.ISSUE@KERBEROS.ISSUE
    Client: Administrator@KERBEROS.ISSUE
    Ticket etype: 18 (AES256)
    Ticket Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Decrypted (with key: <krbtgt aes256, redacted>):
          Client Name: 'Administrator'
          PAC:
            Validation Info:
              User ID: 500
              Primary Group ID: 513
              Logon Domain ID: S-1-5-21-2461982042-2872582096-2145225469
            Pac Requestor:
              SID: S-1-5-21-2461982042-2872582096-2145225469-500
            Pac Server Checksum:
              Signature: 69ec6e0467681d8f53ba74df
            Pac Privilege Server Checksum:
              Signature: 02a43ade0156e6216388e5b0

Sapphire does the S4U2Self+U2U impersonation and comes through as FORGE_SAPPHIRE TGT, same decrypt-and-walk-the-PAC:

FORGE_SAPPHIRE TGT (full mode)

####################
# Kerberos Credential: FORGE_SAPPHIRE TGT
####################
    Server: krbtgt/KERBEROS.ISSUE@KERBEROS.ISSUE
    Client: Administrator@KERBEROS.ISSUE
    Ticket etype: 18 (AES256)
        Decrypted (with key: <krbtgt aes256, redacted>):
          Client Name: 'Administrator'
          PAC:
            Validation Info:
              User ID: 500
              Logon Domain ID: S-1-5-21-2461982042-2872582096-2145225469
            Pac Requestor:
              SID: S-1-5-21-2461982042-2872582096-2145225469-500
            Pac Server Checksum:
              Signature: 7407255e3f6d3fc29ce2b236
            Pac Privilege Server Checksum:
              Signature: 116c6832df76dedb2e0982f9

So all four actions render the header, decrypt the ticket with the key, and walk the full PAC.

Nice work, the output lines up really cleanly with the live cred tracing.

jenkins-eks-metasploit · 2026-07-29T20:41:08Z

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-07-29T22:50:26Z

Pipeline results available

Slice summary:

Test slice 1 - 🔴
Test slice 2 - 🔴
Test slice 3 - 🔴
Test slice 4 - 🔴

Note: build results only accessible to maintainers.

Pushpenderrathore · 2026-07-30T17:46:38Z

The four red slices look like the same thing that hit my Phase 3 PR (#21608) last week rather than anything in this change.

This branch was cut from master on 2026-07-20, and #21711 landed on 2026-07-24, so the job_listener: fix is not in it. Without that, every braceless-hash caller of run_simple / exploit_simple / check_simple raises ArgumentError: wrong number of arguments (given 0, expected 1) under Ruby 3, which is what the cucumber slices trip over. #21690 has the full write-up.

On #21608 the slices went from all four red to all four green after a rebase onto current master, with no code change at all. The diff against master was byte-identical before and after, so the base was the only variable. That is what makes me fairly confident it is the same cause here.

So a rebase onto master should clear it.

Unrelated to the CI, the lab run I posted above still stands. All four forge actions render correctly.

jheysel-r7 · 2026-07-30T18:06:06Z

Looks great @eve0805, thanks for the PR. Would you be able rebase this PR on top of the latest master? There was a regression which is currently causing the additional Jenkins tests to fail at the moment. Once you rebase I'll rerun those tests and they should pass. Thank you.

Also as for @Pushpenderrathore's comment I think it makes sense for KerberosTicketTrace to override the Verbose datastore option 👍

Testing

msf auxiliary(admin/kerberos/forge_ticket) > run
[*] Running module against 172.16.199.209
[*] 172.16.199.209:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260730110126_default_unknown_mit.kerberos.cca_745111.bin
####################
# Kerberos Credential: FORGE_GOLDEN TGT
####################
Creds: 1
  Credential[0]:
    Server: krbtgt/MSF.LOCAL@MSF.LOCAL
    Client: administrator@MSF.LOCAL
    Ticket etype: 18 (AES256)
    Subkey: false
    Ticket Length: 1023
    Ticket Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 2026-07-30 11:01:26 -0700
      Start time: 2026-07-30 11:01:26 -0700
      End time: 2036-07-27 11:01:26 -0700
      Renew Till: 2036-07-27 11:01:26 -0700
[*] Auxiliary module execution completed
msf auxiliary(admin/kerberos/forge_ticket) > set KerberosTicketTrace ticket
KerberosTicketTrace => ticket
msf auxiliary(admin/kerberos/forge_ticket) > run
[*] Running module against 172.16.199.209
[*] 172.16.199.209:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260730110135_default_unknown_mit.kerberos.cca_367139.bin
####################
# Kerberos Credential: FORGE_GOLDEN TGT
####################
Creds: 1
  Credential[0]:
    Server: krbtgt/MSF.LOCAL@MSF.LOCAL
    Client: administrator@MSF.LOCAL
    Ticket etype: 18 (AES256)
    Key: 3762303263633063313335353062653931383733333939323161313830656332
    Subkey: false
    Ticket Length: 1023
    Ticket Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 2026-07-30 11:01:35 -0700
      Start time: 2026-07-30 11:01:35 -0700
      End time: 2036-07-27 11:01:35 -0700
      Renew Till: 2036-07-27 11:01:35 -0700
    Ticket:
      Ticket Version Number: 5
      Realm: MSF.LOCAL
      Server Name: krbtgt/MSF.LOCAL
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Key Version Number: 2
        Cipher:
          TFiOpdJal0ws0ApnaS27Z+w+1TAP43oCpJqa1/obaHqDk1bv4liYxqhr2RNJx5sT1KO5O7r5Cqzf0L9OO4y9HL63be3WLnwtbsFXXlaL9PHdtU0DPbXisGzDWh3o6VGoYcCIg4jnwF+QkRW/1GtHW/HSUNcjW3EKasaef+8RvRhA/AJA0qp5f7GByR6JoxDjx+uSYEu2av+Lm6wC2L2V25WzXMHMe/7WF/Im+9tGb5hJYGOqfExVtJs75w4YWfvVOMJkEhLiVpIEEkdyW+rvcoLmpiMbi4VKuz5IJkrZORuZJt5nADyzBh+gZtVQ7SJjbtrZf9gC6OdVCfc4Q/4uA8foykJJxe3jtKOGQalKpbN4EFWpZegZqvFvRC9tALdxTXFi/j+5sNmbhm1o9pjaz1l5+vTDH2cFtuQqrQJS49Hl0YB4JhG0do4f6K2WAuPuAYkGHCqcqa2A6DoB1d3QahkXM3Qp2tYNiwebuxW+iQ8vfpAVdcsSCaD4wOhDl16kR1vMk6Z4uqcer7jwFbs7jsOtnlKBun+OzTUZcxS3COYzR+Ksu5ZCaBdWRXeqQYJ19OytEEu5Zl/zYYvTKpFtK7hsL6g6u8rigvksVYOsdD8KH/ez1lDDjZeot3O1Lqhi5YF49bYAH2zKU0nWvE8iXiWCLSZvwqgLisid8jaaNyhJy1dAFI4S65hoXc67kgzap5Cx1z7ZXDBci2uqcHGj1M0Zc57C77QR61EyFU4mp+KGfC8BQuD5M3wb+121osFijQw7I86Mj5bdwnysq0kmFS+Y7EF2c40NfFtU57hB99WiiNynn4E/UJPIertAksL5YhgMiqEZsoZWflBJE+2abBZ4bxGaBC4PB1p/eDT6r4kfXjXhIJrTLshegAcWV1Y6IDUTirjxSjiPNd/YDSzhpZJqDKD3Bi2m5QjjQUp0A6qG8rkA/hKjLLGCeu+4ITcvsreHIJ4rjY7NE/5kCZ9L18Bk1SgAUtySefdVz1nR0lZ5aif4dG8IKhjT9Y3tUM+ASuGatkSmSuL2IxCtfNkA/2ULy5YSwHlA3vd18sLuINdg9rW/3oKXLYigyp1mwLVSTrA44ZL2oFBWoVEny2YCr8JcskXK0AvGs2mStwQrl+fxVrQ29kwA1vzFth//3IkdwX+mVZkg03M8ePLpSp1+r8I5ILGhHjKIisens4eT685v0PkHQNfRbmmXRoYsRdPr/kUVMvk2gyZBMW2Sj8BIePJLeJArjeEqU2c+
[*] Auxiliary module execution completed
msf auxiliary(admin/kerberos/forge_ticket) > set KerberosTicketTrace full
KerberosTicketTrace => full
msf auxiliary(admin/kerberos/forge_ticket) > run
[*] Running module against 172.16.199.209
[*] 172.16.199.209:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260730110141_default_unknown_mit.kerberos.cca_039381.bin
####################
# Kerberos Credential: FORGE_GOLDEN TGT
####################
Creds: 1
  Credential[0]:
    Server: krbtgt/MSF.LOCAL@MSF.LOCAL
    Client: administrator@MSF.LOCAL
    Ticket etype: 18 (AES256)
    Key: 3030666530636433646531666633353336333432643038306632363364366330
    Subkey: false
    Ticket Length: 1023
    Ticket Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 2026-07-30 11:01:41 -0700
      Start time: 2026-07-30 11:01:41 -0700
      End time: 2036-07-27 11:01:41 -0700
      Renew Till: 2036-07-27 11:01:41 -0700
    Ticket:
      Ticket Version Number: 5
      Realm: MSF.LOCAL
      Server Name: krbtgt/MSF.LOCAL
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Key Version Number: 2
        Decrypted (with key: fea0c26a1c6d48084fb3e6fb19a7a03affbd9e4a31e152125ddf1326aa2f1c7e):
          Times:
            Auth time: 2026-07-30 11:01:41 -0700
            Start time: 2026-07-30 11:01:41 -0700
            End time: 2036-07-27 11:01:41 -0700
            Renew Till: 2036-07-27 11:01:41 -0700
          Client Addresses: 0
          Transited: tr_type: 0, Contents: ""
          Client Name: 'administrator'
          Client Realm: 'MSF.LOCAL'
          Ticket etype: 18 (AES256)
          Session Key: 3030666530636433646531666633353336333432643038306632363364366330
          Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
          PAC:
            Validation Info:
              Logon Time: 2026-07-30 11:01:41 -0700
              Logoff Time: Never Expires (inf)
              Kick Off Time: Never Expires (inf)
              Password Last Set: No Time Set (0)
              Password Can Change: No Time Set (0)
              Password Must Change: Never Expires (inf)
              Logon Count: 0
              Bad Password Count: 0
              User ID: 500
              Primary Group ID: 513
              User Flags: 0
                .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET
                .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET
                .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET
                .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET
                .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET
                .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET
                .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET
                .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET
                .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET
                .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET
                .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET
              User Session Key: 00000000000000000000000000000000
              User Account Control: 528
                .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET
                .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET
                .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET
                .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET
                .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET
                .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET
                .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET
                .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET
                .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET
                .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET
                .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET
                .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET
                .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET
                .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET
                .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET
                .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET
                .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET
              Sub Auth Status: 0
              Last Successful Interactive Logon: No Time Set (0)
              Last Failed Interactive Logon: No Time Set (0)
              Failed Interactive Logon Count: 0
              Extra SID Count: 0
              Resource Group Count: 0
              Group Count: 5
              Group IDs:
                Relative ID: 513
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
                Relative ID: 512
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
                Relative ID: 520
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
                Relative ID: 518
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
                Relative ID: 519
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
              Logon Domain ID: S-1-5-21-549140833-564715882-1385822508
              Effective Name: 'administrator'
              Full Name: ''
              Logon Script: ''
              Profile Path: ''
              Home Directory: ''
              Home Directory Drive: ''
              Logon Server: ''
              Logon Domain Name: 'MSF.LOCAL'
            Client Info:
              Name: 'administrator'
              Client ID: 2026-07-30 11:01:41 -0700
            Pac Requestor:
              SID: S-1-5-21-549140833-564715882-1385822508-500
            Pac Attributes:
              Flag length: 2
              Flags: 1
                .... .... .... .... .... .... .... ..0. Pac Was Requested: The PAC_WAS_REQUESTED bit is NOT SET
                .... .... .... .... .... .... .... ...1 Pac Was Given Implicitly: The PAC_WAS_GIVEN_IMPLICITLY bit is SET
            Pac Server Checksum:
              Signature: f04ae830a1a8cb56f4096053
            Pac Privilege Server Checksum:
              Signature: 7ce5c9007e8b8db9cf5f439b
[*] Auxiliary module execution completed
msf auxiliary(admin/kerberos/forge_ticket) >

eve0805 · 2026-07-31T01:25:19Z

Looks great @eve0805, thanks for the PR. Would you be able rebase this PR on top of the latest master? There was a regression which is currently causing the additional Jenkins tests to fail at the moment. Once you rebase I'll rerun those tests and they should pass. Thank you.

Also as for @Pushpenderrathore's comment I think it makes sense for KerberosTicketTrace to override the Verbose datastore option 👍

Testing

msf auxiliary(admin/kerberos/forge_ticket) > run
[*] Running module against 172.16.199.209
[*] 172.16.199.209:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260730110126_default_unknown_mit.kerberos.cca_745111.bin
####################
# Kerberos Credential: FORGE_GOLDEN TGT
####################
Creds: 1
  Credential[0]:
    Server: krbtgt/MSF.LOCAL@MSF.LOCAL
    Client: administrator@MSF.LOCAL
    Ticket etype: 18 (AES256)
    Subkey: false
    Ticket Length: 1023
    Ticket Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 2026-07-30 11:01:26 -0700
      Start time: 2026-07-30 11:01:26 -0700
      End time: 2036-07-27 11:01:26 -0700
      Renew Till: 2036-07-27 11:01:26 -0700
[*] Auxiliary module execution completed
msf auxiliary(admin/kerberos/forge_ticket) > set KerberosTicketTrace ticket
KerberosTicketTrace => ticket
msf auxiliary(admin/kerberos/forge_ticket) > run
[*] Running module against 172.16.199.209
[*] 172.16.199.209:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260730110135_default_unknown_mit.kerberos.cca_367139.bin
####################
# Kerberos Credential: FORGE_GOLDEN TGT
####################
Creds: 1
  Credential[0]:
    Server: krbtgt/MSF.LOCAL@MSF.LOCAL
    Client: administrator@MSF.LOCAL
    Ticket etype: 18 (AES256)
    Key: 3762303263633063313335353062653931383733333939323161313830656332
    Subkey: false
    Ticket Length: 1023
    Ticket Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 2026-07-30 11:01:35 -0700
      Start time: 2026-07-30 11:01:35 -0700
      End time: 2036-07-27 11:01:35 -0700
      Renew Till: 2036-07-27 11:01:35 -0700
    Ticket:
      Ticket Version Number: 5
      Realm: MSF.LOCAL
      Server Name: krbtgt/MSF.LOCAL
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Key Version Number: 2
        Cipher:
          TFiOpdJal0ws0ApnaS27Z+w+1TAP43oCpJqa1/obaHqDk1bv4liYxqhr2RNJx5sT1KO5O7r5Cqzf0L9OO4y9HL63be3WLnwtbsFXXlaL9PHdtU0DPbXisGzDWh3o6VGoYcCIg4jnwF+QkRW/1GtHW/HSUNcjW3EKasaef+8RvRhA/AJA0qp5f7GByR6JoxDjx+uSYEu2av+Lm6wC2L2V25WzXMHMe/7WF/Im+9tGb5hJYGOqfExVtJs75w4YWfvVOMJkEhLiVpIEEkdyW+rvcoLmpiMbi4VKuz5IJkrZORuZJt5nADyzBh+gZtVQ7SJjbtrZf9gC6OdVCfc4Q/4uA8foykJJxe3jtKOGQalKpbN4EFWpZegZqvFvRC9tALdxTXFi/j+5sNmbhm1o9pjaz1l5+vTDH2cFtuQqrQJS49Hl0YB4JhG0do4f6K2WAuPuAYkGHCqcqa2A6DoB1d3QahkXM3Qp2tYNiwebuxW+iQ8vfpAVdcsSCaD4wOhDl16kR1vMk6Z4uqcer7jwFbs7jsOtnlKBun+OzTUZcxS3COYzR+Ksu5ZCaBdWRXeqQYJ19OytEEu5Zl/zYYvTKpFtK7hsL6g6u8rigvksVYOsdD8KH/ez1lDDjZeot3O1Lqhi5YF49bYAH2zKU0nWvE8iXiWCLSZvwqgLisid8jaaNyhJy1dAFI4S65hoXc67kgzap5Cx1z7ZXDBci2uqcHGj1M0Zc57C77QR61EyFU4mp+KGfC8BQuD5M3wb+121osFijQw7I86Mj5bdwnysq0kmFS+Y7EF2c40NfFtU57hB99WiiNynn4E/UJPIertAksL5YhgMiqEZsoZWflBJE+2abBZ4bxGaBC4PB1p/eDT6r4kfXjXhIJrTLshegAcWV1Y6IDUTirjxSjiPNd/YDSzhpZJqDKD3Bi2m5QjjQUp0A6qG8rkA/hKjLLGCeu+4ITcvsreHIJ4rjY7NE/5kCZ9L18Bk1SgAUtySefdVz1nR0lZ5aif4dG8IKhjT9Y3tUM+ASuGatkSmSuL2IxCtfNkA/2ULy5YSwHlA3vd18sLuINdg9rW/3oKXLYigyp1mwLVSTrA44ZL2oFBWoVEny2YCr8JcskXK0AvGs2mStwQrl+fxVrQ29kwA1vzFth//3IkdwX+mVZkg03M8ePLpSp1+r8I5ILGhHjKIisens4eT685v0PkHQNfRbmmXRoYsRdPr/kUVMvk2gyZBMW2Sj8BIePJLeJArjeEqU2c+
[*] Auxiliary module execution completed
msf auxiliary(admin/kerberos/forge_ticket) > set KerberosTicketTrace full
KerberosTicketTrace => full
msf auxiliary(admin/kerberos/forge_ticket) > run
[*] Running module against 172.16.199.209
[*] 172.16.199.209:88 - TGT MIT Credential Cache ticket saved to /Users/jheysel/.msf4/loot/20260730110141_default_unknown_mit.kerberos.cca_039381.bin
####################
# Kerberos Credential: FORGE_GOLDEN TGT
####################
Creds: 1
  Credential[0]:
    Server: krbtgt/MSF.LOCAL@MSF.LOCAL
    Client: administrator@MSF.LOCAL
    Ticket etype: 18 (AES256)
    Key: 3030666530636433646531666633353336333432643038306632363364366330
    Subkey: false
    Ticket Length: 1023
    Ticket Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 2026-07-30 11:01:41 -0700
      Start time: 2026-07-30 11:01:41 -0700
      End time: 2036-07-27 11:01:41 -0700
      Renew Till: 2036-07-27 11:01:41 -0700
    Ticket:
      Ticket Version Number: 5
      Realm: MSF.LOCAL
      Server Name: krbtgt/MSF.LOCAL
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Key Version Number: 2
        Decrypted (with key: fea0c26a1c6d48084fb3e6fb19a7a03affbd9e4a31e152125ddf1326aa2f1c7e):
          Times:
            Auth time: 2026-07-30 11:01:41 -0700
            Start time: 2026-07-30 11:01:41 -0700
            End time: 2036-07-27 11:01:41 -0700
            Renew Till: 2036-07-27 11:01:41 -0700
          Client Addresses: 0
          Transited: tr_type: 0, Contents: ""
          Client Name: 'administrator'
          Client Realm: 'MSF.LOCAL'
          Ticket etype: 18 (AES256)
          Session Key: 3030666530636433646531666633353336333432643038306632363364366330
          Flags: 0x50e00000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT)
          PAC:
            Validation Info:
              Logon Time: 2026-07-30 11:01:41 -0700
              Logoff Time: Never Expires (inf)
              Kick Off Time: Never Expires (inf)
              Password Last Set: No Time Set (0)
              Password Can Change: No Time Set (0)
              Password Must Change: Never Expires (inf)
              Logon Count: 0
              Bad Password Count: 0
              User ID: 500
              Primary Group ID: 513
              User Flags: 0
                .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET
                .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET
                .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET
                .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET
                .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET
                .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET
                .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET
                .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET
                .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET
                .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET
                .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET
              User Session Key: 00000000000000000000000000000000
              User Account Control: 528
                .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET
                .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET
                .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET
                .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET
                .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET
                .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET
                .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET
                .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET
                .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET
                .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET
                .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET
                .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET
                .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET
                .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET
                .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET
                .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET
                .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET
                .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET
              Sub Auth Status: 0
              Last Successful Interactive Logon: No Time Set (0)
              Last Failed Interactive Logon: No Time Set (0)
              Failed Interactive Logon Count: 0
              Extra SID Count: 0
              Resource Group Count: 0
              Group Count: 5
              Group IDs:
                Relative ID: 513
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
                Relative ID: 512
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
                Relative ID: 520
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
                Relative ID: 518
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
                Relative ID: 519
                Attributes: 7
                  ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET
                  .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET
                  .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET
                  .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET
                  .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET
              Logon Domain ID: S-1-5-21-549140833-564715882-1385822508
              Effective Name: 'administrator'
              Full Name: ''
              Logon Script: ''
              Profile Path: ''
              Home Directory: ''
              Home Directory Drive: ''
              Logon Server: ''
              Logon Domain Name: 'MSF.LOCAL'
            Client Info:
              Name: 'administrator'
              Client ID: 2026-07-30 11:01:41 -0700
            Pac Requestor:
              SID: S-1-5-21-549140833-564715882-1385822508-500
            Pac Attributes:
              Flag length: 2
              Flags: 1
                .... .... .... .... .... .... .... ..0. Pac Was Requested: The PAC_WAS_REQUESTED bit is NOT SET
                .... .... .... .... .... .... .... ...1 Pac Was Given Implicitly: The PAC_WAS_GIVEN_IMPLICITLY bit is SET
            Pac Server Checksum:
              Signature: f04ae830a1a8cb56f4096053
            Pac Privilege Server Checksum:
              Signature: 7ce5c9007e8b8db9cf5f439b
[*] Auxiliary module execution completed
msf auxiliary(admin/kerberos/forge_ticket) >

Thanks @jheysel-r7!
I've rebased this PR onto the latest master and force-pushed the updated branch. The additional Jenkins tests should now be ready to rerun.

Pushpenderrathore · 2026-07-31T19:05:23Z

Had another look, this one looks separate from the Jenkins slices I mentioned earlier.

Only one job really failed, the five "cancelled" are just fail-fast siblings. The real one is Ruby 3.3 rspec --tag ~content REMOTE_DB=1:

rspec ./spec/api/json_rpc_spec.rb:522 # Metasploit's json-rpc analyze

Failed again on the rerun, so not flake, and nowhere near this diff.

This appears to be a regression already present on master. The rebase landed on 362e5e525e, and master was red on that spec from 919ffe0a through 362e5e525e. #21740 fixed it at 7fca144afc by swapping the analyze test payload to linux/x86/meterpreter_reverse_http. The rebase was right, it just landed about 20 hours before the fix.

Since Verify runs on the merge ref, GitHub has already recalculated it (Merge d183fc58ed into 7fca144afc), so a rerun should go green with nothing pushed.

@jheysel-r7 the Jenkins results above predate the rebase, so they haven't hit d183fc5 yet. Entirely up to you on timing, just flagging in case it folds in with the rerun.

jenkins-eks-metasploit · 2026-07-31T22:01:26Z

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

jenkins-eks-metasploit · 2026-08-01T00:47:47Z

Pipeline results available

Slice summary:

Test slice 1 - 🟢
Test slice 2 - 🟢
Test slice 3 - 🟢
Test slice 4 - 🟢

Note: build results only accessible to maintainers.

github-project-automation Bot added this to Metasploit Kanban Jul 21, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Jul 21, 2026

github-actions Bot added the additional-testing-required label Jul 21, 2026

jheysel-r7 added GSoC Google Summer of Code project PRs enhancement rn-enhancement release notes enhancement labels Jul 29, 2026

jheysel-r7 self-assigned this Jul 29, 2026

jheysel-r7 moved this from Todo to In Progress in Metasploit Kanban Jul 30, 2026

eve0805 force-pushed the feature/kerberos-forged-ticket-trace-v2 branch from d8e1ee9 to d183fc5 Compare July 31, 2026 01:22

jheysel-r7 moved this from In Progress to What about Second Review? in Metasploit Kanban Jul 31, 2026

adfoster-r7 reviewed Aug 6, 2026

View reviewed changes

Comment thread modules/auxiliary/admin/kerberos/forge_ticket.rb Outdated

adfoster-r7 moved this from What about Second Review? to Waiting on Contributor in Metasploit Kanban Aug 6, 2026

eve0805 added 2 commits August 7, 2026 09:18

Add Kerberos trace support for forged tickets

27bae37

Preserve forged ticket storage response

25e95e9

eve0805 force-pushed the feature/kerberos-forged-ticket-trace-v2 branch from d183fc5 to 25e95e9 Compare August 7, 2026 01:34

adfoster-r7 approved these changes Aug 7, 2026

View reviewed changes

github-project-automation Bot moved this from Waiting on Contributor to In Progress in Metasploit Kanban Aug 7, 2026

Navigation Menu

Uh oh!

Add Kerberos trace support for forged tickets - #21691

Add Kerberos trace support for forged tickets#21691
eve0805 wants to merge 2 commits into
rapid7:masterfrom
eve0805:feature/kerberos-forged-ticket-trace-v2

eve0805 commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

Pushpenderrathore commented Jul 26, 2026 •

edited

Loading

Uh oh!

jenkins-eks-metasploit Bot commented Jul 29, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 29, 2026

Uh oh!

Pushpenderrathore commented Jul 30, 2026

Uh oh!

jheysel-r7 commented Jul 30, 2026

Uh oh!

eve0805 commented Jul 31, 2026

Testing

Uh oh!

Pushpenderrathore commented Jul 31, 2026 •

edited

Loading

Uh oh!

jenkins-eks-metasploit Bot commented Jul 31, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Aug 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

eve0805 commented Jul 21, 2026

Summary

Trace modes

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

Pushpenderrathore commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jenkins-eks-metasploit Bot commented Jul 29, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Jul 29, 2026

Uh oh!

Pushpenderrathore commented Jul 30, 2026

Uh oh!

jheysel-r7 commented Jul 30, 2026

Testing

Uh oh!

eve0805 commented Jul 31, 2026

Testing

Uh oh!

Pushpenderrathore commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jenkins-eks-metasploit Bot commented Jul 31, 2026

Uh oh!

jenkins-eks-metasploit Bot commented Aug 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Pushpenderrathore commented Jul 26, 2026 •

edited

Loading

Pushpenderrathore commented Jul 31, 2026 •

edited

Loading