Impacket's getST.py requests a Kerberos service ticket from a KDC using a password, NTLM hash, AES key, or cached TGT, then saves the ticket as a Kerberos credential cache (.ccache). It also supports S4U-based service-account impersonation when Active Directory delegation conditions are met. The ordinary service-ticket request can support Kerberoasting workflows; it does not extract a ticket from a supplied TGS file or crack ticket material.
Python
RESTRICTED_ACCESS_BLUR_MARKER