Skip to main content

​
Credentials

R4t stores authentication credentials in its SQLite database. Multiple credential types are supported — passwords, NT hashes, Kerberos ccache files, PFX certificates, PEM certificate+key pairs, and AES keys. A single credential can be set as the active default for all commands.

​
The creds Command

r4t creds <subcommand> [flags]

​
Subcommands

​
creds add

Add a credential to the database. 
# Password-based
r4t creds add --username jsmith --password 'P@ssword1' --domain corp.example.com

# NT hash (LM:NT or just NT)
r4t creds add --username jsmith --hash aad3b435b51404eeaad3b435b51404ee:e10adc3949ba59abbe56e057f20f883e --domain corp.example.com

# PFX certificate
r4t creds add --username jsmith --pfx /tmp/jsmith.pfx --pfx-password '' --domain corp.example.com

# PEM certificate + private key
r4t creds add --username jsmith --cert /tmp/jsmith.crt --key /tmp/jsmith.key --domain corp.example.com

# Kerberos ccache
r4t creds add --username jsmith --ccache /tmp/krb5cc_1000 --domain corp.example.com

# AES key
r4t creds add --username jsmith --aes <aes-key> --domain corp.example.com

# Machine account
r4t creds add --username DC01 --hostname DC01$ --hash <hash> --domain corp.example.com

# With notes
r4t creds add --username jsmith --password 'P@ssword1' --domain corp.example.com --notes "Found in GPP"

​
Flags for creds add

FlagDescription
-u, --usernameUsername or UPN
-p, --passwordCleartext password
--hashNT hash (LM:NT or just NT)
--pfxPath to PFX certificate file
--pfx-passwordPFX passphrase
--certPath to PEM certificate
--keyPath to PEM private key
--ccachePath to Kerberos ccache file
--aesAES-128 or AES-256 key
-d, --domainDomain the credential belongs to
--hostnameMachine account hostname (e.g., DC01$)
--sourceHow the credential was obtained
--notesOperator notes
PFX files are copied into ~/.local/share/r4t/files/pfx/ and the stored path is updated to the local copy.

​
creds list

List all stored credentials. 
r4t creds list

# Show full auth details (passwords, hashes)
r4t creds list --auth
Output includes: ID, username, domain, type (password/hash/cert/ccache/AES), source, and notes. Sensitive values (passwords, hashes) are redacted by default; use --auth to reveal them.

​
creds set

Set a credential as the active default. The active credential is stored in Badger (cfg:credentials) and used automatically by all commands. 
r4t creds set 2
Takes the numeric ID from creds list.

​
creds modify

Modify an existing stored credential. 
r4t creds modify 2 --username newname --domain newdomain.com --notes "Updated"

​
Flags for creds modify

FlagDescription
-u, --usernameNew username
-d, --domainNew domain
--notesNew notes

​
creds remove

Remove a credential from the database. 
r4t creds remove 2

​
How Credentials Are Resolved

When a command needs to authenticate, R4t resolves credentials in this priority order:
  1. Inline flags — --username, --password, --hash, --ccache, --pfx, --cert+--key, --aes, --anonymous
  2. --credential-id flag — use a specific stored credential by ID
  3. Active credential — the credential set via creds set (retrieved from Badger)
  4. Anonymous — unauthenticated if no credential is available (where supported)
This means once you run r4t creds set 1, all subsequent commands authenticate with that credential automatically.

​
Credential Data Model

type Credential struct {
    ID          uint      // Auto-incremented primary key
    UserID      uint      // FK to users table (optional)
    Name        string    // Username or UPN
    Hostname    string    // Machine account hostname (e.g., DC01$)
    Password    string    // Cleartext password
    Hash        string    // NT hash
    PfxFile     string    // Path to stored PFX file
    PfxPassword string    // PFX passphrase
    CertFile    string    // Path to PEM certificate
    KeyFile     string    // Path to PEM private key
    CcacheFile  string    // Path to Kerberos ccache
    AesKey      string    // AES key
    Domain      string    // Associated domain
    TgtID       uint      // FK to TGTs table (optional)
    Source      string    // How obtained
    Notes       string    // Operator notes
    CreatedAt   time.Time
    UpdatedAt   time.Time
    DeletedAt   *time.Time // Soft delete
}

​
Supported Authentication Methods

MethodRequired FieldsUse Case
Passwordname, password, domainStandard AD authentication
NT Hashname, hash, domainPass-the-Hash (LDAP, SMB, etc.)
PFX Certificatename, pfx_file, pfx_password, domainPKINIT, Schannel
PEM Cert + Keyname, cert_file, key_file, domainPKINIT, Schannel
Kerberos ccachename, ccache_file, domainPass-the-Ticket
AES Keyname, aes_key, domainKerberos with AES key
Anonymous—Unauthenticated operations
Shadow (Key only)key_file, domainShadow credential attacks

​
Using Credentials Inline

If you don’t want to store credentials, you can pass them inline on any command: 
# Password
r4t ldap get users -u jsmith -p 'P@ssword1' -d corp.example.com

# Hash
r4t ldap get users -u jsmith --hash <ntlm-hash> -d corp.example.com

# ccache
r4t ldap get users --ccache /tmp/jsmith.ccache

# PFX
r4t adcs nt --pfx /tmp/jsmith.pfx

# AES key
r4t krb tgt --aes <aes-key> -u jsmith -d corp.example.com

# Anonymous
r4t ldap query --anonymous --filter "(objectClass=*)"

​
Kerberos Ticket Storage

Kerberos TGTs and TGSs obtained during a session can be stored in the database:
TableDescription
tgtsTicket Granting Tickets
tgssTicket Granting Service tickets
These are linked to the credential record that was used to obtain them. Use r4t tickets to manage saved Kerberos tickets.