Is possession of a Kerberos .keytab
file (as generated by e.g. ktpass) sufficient to 'pretend to be' that user on a windows machine? For example, create a process as, or access network resources (e.g. a share) as that user?
If so, are there tools that can demonstrate this?
FWIW - I have been able to demonstrate that possession of a .keytab file for user X:
- is sufficient for a client to authenticate themselves as user X to a SPNEGO web service.
- seems to be sufficient for that SPNEGO web service to impersonate user X (a local logon occurs) but with limited (ie impersonation, not delegation) privileges. Can I go further and actually delegate?