Retrieve password from kerberos keytab file

Question

I am using hadoop with kerberos keytab file name userid.keytab for a long while. But now i m not aware the password. Is it anyway to get password from the keytab file.

Accrete

Answer 1

No, you can't. The only thing you can get from a keytab file is the principal name:

$ ktutil 
ktutil:  read_kt test.wtk 
ktutil:  list 
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    1                [email protected]

Keytab contains pairs of principal and encrypted keys (which are derived from the Kerberos password), no way to get back the password from these data.

Oxyacetylene

Answer 2

Keytab has a principal name at the very least, but can also hold the NTLM hash of the password, next to AES hashes of the same password.

Extract hashes with https://github.com/sosdave/KeyTabExtract

Musicology