What do "Default principal", "Service principal" and krbtgt mean in the output of klist?

The default principal is the logged-in Kerberos identity (user@REALM), a service principal is the identity of a service, and krbtgt is the service principal of the KDC's ticket service, so a krbtgt/REALM ticket is the TGT.

klist lists the tickets in the user's credential cache, for example:

Default principal: davdur@G001.CKTECK.COM
Valid starting   Expires          Service principal
...              ...              krbtgt/G001.CKTECK.COM@G001.CKTECK.COM

• A principal is any identity that Kerberos knows. The default principal is the one this cache belongs to: the user who logged in. The realm is written in capitals.
• A service principal (SPN) names a service that tickets are issued for, like host/lc-001.g001.ckteck.com or HTTP/web.g001.ckteck.com.
• krbtgt is the special account of the Ticket Granting Service. A ticket for krbtgt/REALM is the Ticket Granting Ticket. It is encrypted with the krbtgt account's key.

That last fact is why the krbtgt key is so sensitive: anyone who steals it can forge TGTs for any user (a "Golden Ticket").

The ticket also has a lifetime (often 10 hours), so a stolen ticket is only useful for a limited time.

Go deeper:

• MIT Kerberos: klist — what each column of the output means.
• Microsoft Learn: Active Directory accounts — the KRBTGT account and why its password must be protected.
• MITRE ATT&CK: Golden Ticket (T1558.001) — how a stolen krbtgt key is abused, and detections.