Domain-Joined Host
Although not common, Linux computers can connect to Active Directory to provide centralized identity management and integrate with the organization's systems, giving users the ability to have a single identity to authenticate on Linux and Windows computers.
Ticket Files (ccache)
They are saved as ccache files. You can find some using the find command:
find -iname '*ccache*' -readable 2> /dev/null
Note that we have passed the readable flag. If we want to impersonate a user, we need to be able to read the ticket file.
The KRB5CCNAME Environment Variable
By default, the location of the Kerberos ticket is stored in the environment variable KRB5CCNAME. This variable can identify if Kerberos tickets are being used or if the default location for storing Kerberos tickets is changed. These ccache files are protected by reading and write permissions, but a user with elevated privileges or root privileges could easily gain access to these tickets.
Keytab Files
A keytab is a file containing pairs of Kerberos principals and encrypted keys (which are derived from the Kerberos password). You can use a keytab file to authenticate to various remote systems using Kerberos without entering a password. However, when you change your password, you must recreate all your keytab files.
Keytab files commonly allow scripts to authenticate automatically using Kerberos without requiring human interaction or access to a password stored in a plain text file. For example, a script can use a keytab file to access files stored in the Windows share folder.
find -iname '*keytab*' -readable 2> /dev/null
Extract Credentials from a Keytab File
You can install KeyTabExtract. This tool can extract credentials from a keytab file.
python3 keytabextract.py /path/to/keytab/file
Useful Commands
List realm information
realm list
Check if the host is joined to a domain
ps -ef | grep -i "winbind\|sssd"
klist
klist