Add offline Kerberos ticket trace output#21638
Conversation
|
Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected. We've added the |
jheysel-r7
left a comment
There was a problem hiding this comment.
Hey @eve0805, thanks for this PR, I really like this idea.
A few comments:
-
I'm going to try and land #21637 today. Once that PR is landed would you be able to pull down the updated
upstream-masterbranch and then rebase this PR on top of master? I noticed this PR and 21637 share some of the same changes and it would be easier to review if those changes are isolated. -
I was doing some brief testing. It would be great if the
--traceoption could accept either theidof a single ticket or thepathof a single ticket so individual tickets in the Kerberos Cache could be printed a time. -
Could you please add a short form argument of
--traceie.-tto maintain parody with the rest of the options.
Summary
This reuses the existing Kerberos ticket trace formatting for offline Kerberos artifact workflows, so stored and converted tickets can be inspected with the same output style used during live Kerberos authentication.
Implemented functionality:
Added shared offline trace rendering through
Krb5CcachePresenter, includingmetadata,ticket, andfulltrace modes.Updated
Ticket#print_contentsto supportKerberosTicketTrace, allowing offline ticket inspection to print structured trace output.Added
KerberosTicketTracesupport toauxiliary/admin/kerberos/ticket_converter, so converted.ccache/.kirbiartifacts can be printed with the same trace conventions.Added
klist --trace metadata|ticket|fullsupport to the console DB command, making stored Kerberos tickets easier to inspect from msfconsole.Reused the same credential presentation path for live and offline ticket output to keep formatting consistent.
Added RSpec coverage for the presenter, logger subscriber formatting, ticket converter behavior, and
klist --trace.