Add standalone --generate-st#1239
Open
azoxlpf wants to merge 1 commit into
Open
Conversation
azoxlpf
requested review from
Marshall-Hallenbeck,
NeffIsBack,
mpgn and
zblurx
as code owners
NeffIsBack
requested changes
May 14, 2026
Member
NeffIsBack
left a comment
NeffIsBack
left a comment
There was a problem hiding this comment.
As always, thanks for the PR!
So my thoughts on this: Wouldn't it make sense if we would modify&PR to impacket that the generated/used ST in the kerberos authentication is set as self.__TGS and we simply exract that after successful auth and store it? Otherwise we would 1. do a second authentication attempt and 2. there is a lot of room for error when trying to recreate the original handshake (e.g. trust auth etc.).
Thoughts guys?
| delegate_arg = smb_parser.add_argument("--delegate", action="store", help="Impersonate user with S4U2Self + S4U2Proxy") | ||
| delegate_spn_arg = smb_parser.add_argument("--delegate-spn", action=get_conditional_action(_StoreAction), make_required=[], help="SPN to use for S4U2Proxy, if not specified the SPN used will be cifs/<target>", type=str) | ||
| generate_st = smb_parser.add_argument("--generate-st", type=str, dest="generate_st", action=get_conditional_action(_StoreAction), make_required=[], help="Store the S4U Service Ticket in the specified file") | ||
| smb_parser.add_argument("--spn", action="store", help="SPN to use for the Service Ticket. With --delegate it's the SPN used for S4U2Proxy (defaults to cifs/<target>). With --generate-st (and without --delegate) it's the SPN of the target service to request a ST for.", type=str) |
Member
There was a problem hiding this comment.
I think the last sentence (regarding --generate-st) is self explanatory, so imo we should remove it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Following the discussion on #1224, this change extends
--generate-stso you can request a normal service ticket for any SPN (TGT + getKerberosTGS, same idea as Impacket’s getST.py) without--delegate, while keeping the existing S4U flow when--delegateis used. It also renames--delegate-spnto--spn, since that flag is no longer only about delegation, it is the SPN for both constrained-delegation/RBCD and plain ST export.Type of change
Insert an "x" inside the brackets for relevant items (do not delete options)
Setup guide for the review
run nxc smb ip -u 'user' -p 'password' --generate-st user --spn 'CIFS/DC01.domain'
Screenshots (if appropriate):
With
--delegate:Without
--delegate:Checklist:
Insert an "x" inside the brackets for completed and relevant items (do not delete options)
poetry run ruff check ., use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)