Documentation Index
Fetch the complete documentation index at: https://wiki.krkn.tech/llms.txt
Use this file to discover all available pages before exploring further.
Credentials
R4t stores authentication credentials in its SQLite database. Multiple credential types are supported — passwords, NT hashes, Kerberos ccache files, PFX certificates, PEM certificate+key pairs, and AES keys. A single credential can be set as the active default for all commands.
The creds Command
r4t creds <subcommand> [flags]
Subcommands
creds add
Add a credential to the database.
# Password-based
r4t creds add --username jsmith --password 'P@ssword1' --domain corp.example.com
# NT hash (LM:NT or just NT)
r4t creds add --username jsmith --hash aad3b435b51404eeaad3b435b51404ee:e10adc3949ba59abbe56e057f20f883e --domain corp.example.com
# PFX certificate
r4t creds add --username jsmith --pfx /tmp/jsmith.pfx --pfx-password '' --domain corp.example.com
# PEM certificate + private key
r4t creds add --username jsmith --cert /tmp/jsmith.crt --key /tmp/jsmith.key --domain corp.example.com
# Kerberos ccache
r4t creds add --username jsmith --ccache /tmp/krb5cc_1000 --domain corp.example.com
# AES key
r4t creds add --username jsmith --aes <aes-key> --domain corp.example.com
# Machine account
r4t creds add --username DC01 --hostname DC01$ --hash <hash> --domain corp.example.com
# With notes
r4t creds add --username jsmith --password 'P@ssword1' --domain corp.example.com --notes "Found in GPP"
Flags for creds add
| Flag | Description |
|---|
-u, --username | Username or UPN |
-p, --password | Cleartext password |
--hash | NT hash (LM:NT or just NT) |
--pfx | Path to PFX certificate file |
--pfx-password | PFX passphrase |
--cert | Path to PEM certificate |
--key | Path to PEM private key |
--ccache | Path to Kerberos ccache file |
--aes | AES-128 or AES-256 key |
-d, --domain | Domain the credential belongs to |
--hostname | Machine account hostname (e.g., DC01$) |
--source | How the credential was obtained |
--notes | Operator notes |
PFX files are copied into ~/.local/share/r4t/files/pfx/ and the stored path is updated to the local copy.
creds list
List all stored credentials.
r4t creds list
# Show full auth details (passwords, hashes)
r4t creds list --auth
--auth to reveal them.
creds set
Set a credential as the active default. The active credential is stored in Badger (cfg:credentials) and used automatically by all commands.
Takes the numeric ID from creds list.
creds modify
Modify an existing stored credential.
r4t creds modify 2 --username newname --domain newdomain.com --notes "Updated"
Flags for creds modify
| Flag | Description |
|---|
-u, --username | New username |
-d, --domain | New domain |
--notes | New notes |
creds remove
Remove a credential from the database.
How Credentials Are Resolved
When a command needs to authenticate, R4t resolves credentials in this priority order:
- Inline flags —
--username, --password, --hash, --ccache, --pfx, --cert+--key, --aes, --anonymous
--credential-id flag — use a specific stored credential by ID- Active credential — the credential set via
creds set (retrieved from Badger)
- Anonymous — unauthenticated if no credential is available (where supported)
This means once you run r4t creds set 1, all subsequent commands authenticate with that credential automatically.
Credential Data Model
type Credential struct {
ID uint // Auto-incremented primary key
UserID uint // FK to users table (optional)
Name string // Username or UPN
Hostname string // Machine account hostname (e.g., DC01$)
Password string // Cleartext password
Hash string // NT hash
PfxFile string // Path to stored PFX file
PfxPassword string // PFX passphrase
CertFile string // Path to PEM certificate
KeyFile string // Path to PEM private key
CcacheFile string // Path to Kerberos ccache
AesKey string // AES key
Domain string // Associated domain
TgtID uint // FK to TGTs table (optional)
Source string // How obtained
Notes string // Operator notes
CreatedAt time.Time
UpdatedAt time.Time
DeletedAt *time.Time // Soft delete
}
Supported Authentication Methods
| Method | Required Fields | Use Case |
|---|
| Password | name, password, domain | Standard AD authentication |
| NT Hash | name, hash, domain | Pass-the-Hash (LDAP, SMB, etc.) |
| PFX Certificate | name, pfx_file, pfx_password, domain | PKINIT, Schannel |
| PEM Cert + Key | name, cert_file, key_file, domain | PKINIT, Schannel |
| Kerberos ccache | name, ccache_file, domain | Pass-the-Ticket |
| AES Key | name, aes_key, domain | Kerberos with AES key |
| Anonymous | — | Unauthenticated operations |
| Shadow (Key only) | key_file, domain | Shadow credential attacks |
Using Credentials Inline
If you don’t want to store credentials, you can pass them inline on any command:
# Password
r4t ldap get users -u jsmith -p 'P@ssword1' -d corp.example.com
# Hash
r4t ldap get users -u jsmith --hash <ntlm-hash> -d corp.example.com
# ccache
r4t ldap get users --ccache /tmp/jsmith.ccache
# PFX
r4t adcs nt --pfx /tmp/jsmith.pfx
# AES key
r4t krb tgt --aes <aes-key> -u jsmith -d corp.example.com
# Anonymous
r4t ldap query --anonymous --filter "(objectClass=*)"
Kerberos Ticket Storage
Kerberos TGTs and TGSs obtained during a session can be stored in the database:
| Table | Description |
|---|
tgts | Ticket Granting Tickets |
tgss | Ticket Granting Service tickets |
r4t tickets to manage saved Kerberos tickets.
