Skip to content

Add offline Kerberos ticket trace output#21638

Open
eve0805 wants to merge 2 commits into
rapid7:masterfrom
eve0805:feature/kerberos-offline-artifact-trace
Open

Add offline Kerberos ticket trace output#21638
eve0805 wants to merge 2 commits into
rapid7:masterfrom
eve0805:feature/kerberos-offline-artifact-trace

Conversation

@eve0805

@eve0805 eve0805 commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Summary

This reuses the existing Kerberos ticket trace formatting for offline Kerberos artifact workflows, so stored and converted tickets can be inspected with the same output style used during live Kerberos authentication.

Implemented functionality:

  1. Added shared offline trace rendering through Krb5CcachePresenter, including metadata, ticket, and full trace modes.

  2. Updated Ticket#print_contents to support KerberosTicketTrace, allowing offline ticket inspection to print structured trace output.

  3. Added KerberosTicketTrace support to auxiliary/admin/kerberos/ticket_converter, so converted .ccache / .kirbi artifacts can be printed with the same trace conventions.

  4. Added klist --trace metadata|ticket|full support to the console DB command, making stored Kerberos tickets easier to inspect from msfconsole.

  5. Reused the same credential presentation path for live and offline ticket output to keep formatting consistent.

  6. Added RSpec coverage for the presenter, logger subscriber formatting, ticket converter behavior, and klist --trace.

@github-actions

github-actions Bot commented Jul 2, 2026

Copy link
Copy Markdown

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.

@smcintyre-r7 smcintyre-r7 added the GSoC Google Summer of Code project PRs label Jul 8, 2026
@jheysel-r7 jheysel-r7 self-assigned this Jul 8, 2026

@jheysel-r7 jheysel-r7 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @eve0805, thanks for this PR, I really like this idea.

A few comments:

  1. I'm going to try and land #21637 today. Once that PR is landed would you be able to pull down the updated upstream-master branch and then rebase this PR on top of master? I noticed this PR and 21637 share some of the same changes and it would be easier to review if those changes are isolated.

  2. I was doing some brief testing. It would be great if the --trace option could accept either the id of a single ticket or the path of a single ticket so individual tickets in the Kerberos Cache could be printed a time.

  3. Could you please add a short form argument of --trace ie. -t to maintain parody with the rest of the options.

@jheysel-r7 jheysel-r7 moved this from Todo to In Progress in Metasploit Kanban Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

additional-testing-required GSoC Google Summer of Code project PRs

Projects

Status: In Progress

Development

Successfully merging this pull request may close these issues.

3 participants