Wonka: Kerberos Ticket Extraction From Lsa

TL;DR: Wonka is a windows tool that impersonates system to enumerate logon sessions via lsa and extract kerberos tickets, exporting them as base64 blobs for analysis.

Context Wonka is presented as a utility for security practitioners who need to collect Kerberos artifacts from live Windows systems. The project targets authorized testing and forensic collection scenarios where inspection of Kerberos tickets (TGTs and service tickets) is required.

What’s New The tool automates SYSTEM impersonation to access LSA data structures, enumerates logon sessions with LsaEnumerateLogonSessions, and retrieves Kerberos ticket blobs through LsaCallAuthenticationPackage. Outputs include per-session metadata and Base64-encoded ticket contents to facilitate transfer and offline analysis.

Technical Breakdown Wonka documents use of several Windows APIs: OpenProcessToken for token access, LsaRegisterLogonProcess to register with the Local Security Authority, and LsaEnumerateLogonSessions/LsaCallAuthenticationPackage for session discovery and Kerberos interaction. Conceptually, the tool elevates context to SYSTEM, enumerates sessions, queries the Kerberos authentication package for tickets, and formats the retrieved blobs as Base64-encoded strings accompanied by principal and time metadata.

Use Cases Primary use cases described in the repository are authorized penetration testing, red-team operations, and forensic collection of Kerberos tickets for investigation. The README emphasizes legal and authorized contexts for operation.

Limitations Documented limitations include the need for Administrator privileges and a development dependency on .NET 7.0. The README does not provide detection signatures or mappings to ATT&CK IDs. Runtime defenses, endpoint protection, and platform-specific hardening may prevent successful access to LSA or ticket material.

kerberos #lsa #ticket_extraction #forensics #tool

SOURCE: https://github.com/Shac0x/Wonka