Impacket getPac
Retrieve the PAC (Privilege Attribute Certificate) for a target user via the S4U2self extension. Useful for inspecting group memberships from a low-privileged context, validating that S4U is allowed, and as a building block for delegation attacks.
- Tool
- impacket-getPac
- Category
- Credential Attacks / Ticket Forgery & Conversion
- Platform
- linux
- Requires
- password
- Protocols
- KERBEROS
Syntax
Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.
impacket-getPac -targetUser <target_user> '<domain>/<user>:<password>'Credential variants
The same attack using a different authentication material.
NTLM Hash requires NTLM hash
impacket-getPac -targetUser <target_user> -hashes ':<hash>' '<domain>/<user>'Examples
impacket-getPac -targetUser administrator 'CORP/jdoe:Password123!'Tags
References
Related commands
- Impacket describeTicket Parse and display the contents of a Kerberos ticket (.ccache or .kirbi)
- Impacket Diamond Ticket Forge a Diamond Ticket: request a legitimate TGT from the KDC and then patch its PAC…
- Impacket Golden Ticket Forge a Golden Ticket (TGT) using the krbtgt NTLM hash
- Impacket Silver Ticket Forge a Silver Ticket (TGS) for a specific service using its NTLM hash
- Impacket Ticket Converter Convert Kerberos tickets between kirbi (Windows) and ccache (Linux) formats
- Impacket ticketer.py Golden Ticket Forge a Golden Ticket (TGT signed with the krbtgt key) granting any user, any privilege,…