Skip to content

Add offline Kerberos ticket trace output#21638

Open
eve0805 wants to merge 2 commits into
rapid7:masterfrom
eve0805:feature/kerberos-offline-artifact-trace
Open

Add offline Kerberos ticket trace output#21638
eve0805 wants to merge 2 commits into
rapid7:masterfrom
eve0805:feature/kerberos-offline-artifact-trace

Conversation

@eve0805

@eve0805 eve0805 commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Summary

This reuses the existing Kerberos ticket trace formatting for offline Kerberos artifact workflows, so stored and converted tickets can be inspected with the same output style used during live Kerberos authentication.

Implemented functionality:

  1. Added shared offline trace rendering through Krb5CcachePresenter, including metadata, ticket, and full trace modes.

  2. Updated Ticket#print_contents to support KerberosTicketTrace, allowing offline ticket inspection to print structured trace output.

  3. Added KerberosTicketTrace support to auxiliary/admin/kerberos/ticket_converter, so converted .ccache / .kirbi artifacts can be printed with the same trace conventions.

  4. Added klist --trace metadata|ticket|full support to the console DB command, making stored Kerberos tickets easier to inspect from msfconsole.

  5. Reused the same credential presentation path for live and offline ticket output to keep formatting consistent.

  6. Added RSpec coverage for the presenter, logger subscriber formatting, ticket converter behavior, and klist --trace.

@github-actions

github-actions Bot commented Jul 2, 2026

Copy link
Copy Markdown

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

2 participants