impacket-gettgt

View documentation for the original command

$ tldr getTGT.py

impacket-gettgt [-h] [-hashtype {lm,ntlm}] [-user USER] [-nthash NTHASH] [-aesKey AESKEY] [-dc-ip DC_IP] [-k] [-no-pass] [-request] domain/username

-h, --help
    Show help message and exit

-hashtype {lm,ntlm}
    Hash type for authentication; options: lm, ntlm (default)

-user USER
    Username for authentication instead of positional arg

-nthash NTHASH
    NTLM hash (pass-the-hash) instead of password

-aesKey AESKEY
    AES-256 key for Kerberos authentication

-dc-ip DC_IP
    IP address of target Domain Controller

-k
    Use Kerberos ccache credentials (KRB5CCNAME)

-no-pass
    Skip password prompt (for scripting)

-request
    Force TGT request even if cached

impacket-gettgt is a tool from the Impacket suite designed to request a Ticket Granting Ticket (TGT) from an Active Directory Kerberos Key Distribution Center (KDC). It supports authentication via password, NTLM hash (pass-the-hash), or AES keys, making it useful for penetration testing and red team operations.

By providing domain credentials, the tool sends an AS-REQ to the KDC (port 88/TCP) and saves the resulting TGT in both ccache (for tools like impacket-ntlmrelayx) and .kirbi formats (for Tiket tools). This enables subsequent Kerberos-based attacks like pass-the-ticket, overpass-the-hash, or service ticket requests with impacket-getST.

Common workflow: impacket-gettgt domain/user:pass or with hash -nthash. Set KRB5CCNAME env var to use the TGT. Detection risks include event logs (4768/4769) on Windows DCs.

Requires TCP/88 access to DC; generates auth logs (Event ID 4768); invalid creds fail silently sometimes; Python deps (impacket, pyasn1); not for production use.

Generates user.tgt@DOMAIN.ccache (export KRB5CCNAME=...) and .kirbi ticket file.

impacket-gettgt -nthash aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 TEST/user
Outputs TGT for further attacks.

Part of Impacket library by SecureAuth (now Fortra), evolved since 2010 for protocol fuzzing/pentesting; getTGT added for Kerberos ops in v0.9+.

impacket-getST(1), impacket-psexec(1), kinit(1)