Skip to content

Instantly share code, notes, and snippets.

@raandree
Created February 15, 2022 10:53
Show Gist options
  • Save raandree/8f2708ae925ae3d4ecb2e576e5cc2306 to your computer and use it in GitHub Desktop.
Save raandree/8f2708ae925ae3d4ecb2e576e5cc2306 to your computer and use it in GitHub Desktop.
Get all Kerberos tickets from all logon sessions
$sessions = klist sessions
$pattern = '\[(\d+)\] Session \d \d:(?<LowPart>0)x(?<HighPart>[a-f0-9]+)'
$sessions = foreach ($line in $sessions)
{
if ($line -match $pattern)
{
New-Object PSObject -Property @{
LowPart = $Matches.LowPart
HighPart = $Matches.HighPart
}
}
}
$sessionsTickets = foreach ($session in $sessions)
{
$result = New-Object PSObject -Property @{
Session = "$($session.LowPart)x$($session.HighPart)"
Tickets = klist tickets -lh $session.LowPart -li $session.HighPart
}
Write-Host "'klist tickets -lh $($session.LowPart) -li $($session.HighPart)' knows about $($result.Tickets.Count) tickets"
$result
}
#to view all tickets
$sessionsTickets.Tickets
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment