{"id":19390640,"url":"https://github.com/mandiant/sssdkcmextractor","last_synced_at":"2025-04-24T00:31:27.761Z","repository":{"id":146044988,"uuid":"243651173","full_name":"mandiant/SSSDKCMExtractor","owner":"mandiant","description":null,"archived":false,"fork":false,"pushed_at":"2023-08-11T01:04:37.000Z","size":9,"stargazers_count":54,"open_issues_count":2,"forks_count":26,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-02T22:51:13.650Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mandiant.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-02-28T01:13:48.000Z","updated_at":"2025-01-18T02:54:37.000Z","dependencies_parsed_at":null,"dependency_job_id":"684d4792-3039-4713-af0f-ab9168b3a9d7","html_url":"https://github.com/mandiant/SSSDKCMExtractor","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mandiant%2FSSSDKCMExtractor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mandiant%2FSSSDKCMExtractor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mandiant%2FSSSDKCMExtractor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mandiant%2FSSSDKCMExtractor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mandiant","download_url":"https://codeload.github.com/mandiant/SSSDKCMExtractor/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250539416,"owners_count":21447305,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-10T10:22:31.957Z","updated_at":"2025-04-24T00:31:27.752Z","avatar_url":"https://github.com/mandiant.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SSSDKCMExtractor\n\nThis tool will decrypt Kerberos Cache Manager (KCM) databases used by the System Security\nServices Daemon (SSSD). Although older Red Hat Enterprise Linux distributions stored Kerberos caches in the /tmp directory, newer installations use the SSSD Kerberos Cache Manager instead.\n\nThe Kerberos caches are maintained in a TDB database (Samba Trivial Database).\nBy default, the database file is located at the path: \n/var/lib/sss/secrets/secrets.ldb\n\nThe database is parsable with the python-tdb or python3-tdb TDB library.\n\nKerberos payloads are encrypted with AES_256_CBC. The key used to encrypt\nvalues in the database is present at:\n/var/lib/sss/secrets/.secrets.mkey\n\n(NOTE: Both files require root access to read. The secret key is marked\nas hidden on the filesystem via the dot prefix).\n\n## Requirements\n\nInstall the python-tdb or python3-tdb library using your distribution's package manager. \n\nNext, install pycrypto. pip install -r requirements.txt or pip install pycrypto\n\nYou must possess both the secrets.ldb TDB database and the master key\n(.secrets.mkey) to use this tool.\n\n## Usage\npython3 SSSDKCMExtractor.py --database secrets.ldb --key secrets.mkey\n\nOnce the tool finishes parsing and decrypting the relevant database entries,\nthe raw Kerberos JSON payloads from the KCM are displayed.\n\nWe leave it as an exercise to the reader to convert these into a usable ticket file for pass-the-cache and pass-the-ticket operations.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmandiant%2Fsssdkcmextractor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmandiant%2Fsssdkcmextractor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmandiant%2Fsssdkcmextractor/lists"}