How to fix the correct time?
When trying to retrieve Kerberos tickets with impacket via the function GetUserSPNs you can get an error about the time isn’t matching the domain controller (TGT: Kerberos SessionError: KRB_AP_ERR_SKEW Clock skew too great). There are number of ways this can be fixed in my case I tried to do it with both rdate and ntpdate but that didn’t work. Was also trying to disable automatic update of the time with: sudo timedatectl set-ntp 0
Every time the time was reset. Im quite not sure why but I suspect that VirtualBox has some time-sync between the guest and the host in the background. Don’t know if Vmware or Qemu has same sync but anyhow here is how I solved this issue.
Output from:impacket-GetUserSPNs -dc-ip [ip] [domain]/[user]:[pass]
Notice the debug parameter which helps to show the current server time.
The server time is showing Time zone, date and time. In my case I changed the date and time on my host to match the server time. But still it didn’t work!! I found out that the time zone also needs to match in order for it to work!
So remember if you manually change the date and time to match server time. Don’t forget to also match the correct time zone.