KRB5CCNAME with FILE: prefix is treated as a literal filesystem path

Configuration

impacket version:
Python version: 3.12.3 Target OS: Ubuntu 24.04.4

Debug Output With Command String

certipy find -k -no-pass -u '[email protected]' -target 'dc01.contoso.com' -enabled -stdout -debug
...
[+] Failed to load Kerberos cache: [Errno 2] No such file or directory: 'FILE:/tmp/krb5cc_135948'
...

Additional context

Impacket fails to load a valid MIT Kerberos credential cache when KRB5CCNAME includes the standard FILE: cache-type prefix.

For example:

KRB5CCNAME=FILE:/tmp/krb5cc_135948

This works correctly with native Kerberos tools such as klist, but Impacket attempts to open the entire string as a filesystem path:

[+] Failed to load Kerberos cache: [Errno 2] No such file or directory: 'FILE:/tmp/krb5cc_135948'

Cause

CCache.parseFile() passes the complete environment variable directly to CCache.loadFile():

ccache = cls.loadFile(os.getenv('KRB5CCNAME'))

loadFile() then passes it directly to Python's open():

f = open(fileName, 'rb')

KRB5CCNAME is a Kerberos cache identifier in TYPE:residual form, not necessarily a literal path.

Expected behavior

For a FILE: cache, Impacket should remove the cache-type prefix before opening the file:

cache_name = os.getenv("KRB5CCNAME")

if cache_name and cache_name.upper().startswith("FILE:"):
    cache_name = cache_name[5:]

Other cache types such as DIR:, KEYRING:, and KCM: should either be handled appropriately or rejected with a clear unsupported-cache-type message.

Workaround

export KRB5CCNAME="${KRB5CCNAME#FILE:}"

This workaround should not be necessary because FILE:/path/to/cache is a valid Kerberos cache identifier.