Impacket getST.py requests a Kerberos service ticket for a supplied SPN using a password, NTLM hash, AES key, or cached TGT, then writes the ticket to a Kerberos credential cache (.ccache). With suitable constrained-delegation authorization, its S4U2Self/S4U2Proxy flow can request a service ticket on behalf of another identity.
Python
RESTRICTED_ACCESS_BLUR_MARKER