A field-level PAC mutation tool for fuzzing the Kerberos PAC validator, not for forging tickets.
Every existing PAC tool builds a PAC from scratch or from a template and signs the result. That is the right shape for a Golden or Silver ticket, but the wrong shape for studying what a domain controller actually checks. PACMutator does the opposite: it takes a legitimately issued ticket, changes exactly one buffer, field, or signature, leaves the rest byte-for-byte intact, and lets me observe which validation path notices. It is a research instrument for characterizing a validator, not an exploit.
- Parses a PAC into a raw-container model that never round-trips buffer contents through an NDR re-encoder, so an unmutated ticket reflows byte-identically and any change is surgical.
- Gives independent control over each of the four PAC signatures (server, KDC, ticket, extended-KDC): preserve, recompute, zero, strip, or retype.
- Rebuilds the mutated PAC back into a re-encrypted service ticket and emits a usable credential cache.
- Supports a differential method: run the same mutation against a signature-only service and a full-validation service and compare the pair of verdicts.
core/ container model: parse, reflow, byte-identical round-trip gate
buffers/ typed views for individual PAC buffers
signing/ signature operations and the server-signature engine
structural/ buffer-table framing primitives
delivery/ ticket extract / re-encrypt / emit
oracle/ token builder + acceptor for the validation oracles
examples/ end-to-end research cells (enforcement matrix, field hunts)
cli.py command-line entry point
- Python 3.11+
- Impacket
pip install impacketThe tool operates on a service ticket you already hold, extracted with the service key. A minimal round-trip check:
python cli.py extract ticket.ccache --key <service-key-hex> --enctype 18 -o out.pac
python cli.py roundtrip out.pac # must PASS (byte-identical reflow)
python cli.py signtest out.pac --key <service-key-hex> --enctype 18 # must MATCHSee examples/ for complete research cells, including the signature-enforcement matrix and the content-field hunts.
PACMutator requires the target service key, which means it models a post-compromise research position. Its purpose is to map what a domain controller validates, and its output is a characterization of validator behavior, not a bypass. Use it only against systems you own or are explicitly authorized to test.
Written as part of a research series on Windows Server 2025 PAC validation. The accompanying writeups cover the tool design and a field-by-field map of what full validation checks.
MIT