Skip to main content
Pass-the-Ticket is a credential theft technique that lets an adversary authenticate to resources (file shares, other hosts) using a stolen Kerberos ticket, instead of that user’s password.
  • Both ticket types can be stolen and reused: a TGS (service ticket) grants access to one specific service, a TGT (ticket-granting ticket) can be used to request a TGS for any service the account is entitled to.
  • Without administrative privileges, only the current user’s own tickets are reachable (a TGT via fake delegation, plus whatever TGS tickets are already cached).
  • With administrative privileges, LSASS itself can be dumped to pull every TGT and TGS cached on the host, for every logged-on user, not just the current one.

​
Windows (Rubeus / Mimikatz)

Rubeus:
Mimikatz:
Once injected (/ptt, or after kerberos::ptt), remoting to another host is very easy
Rubeus.exe asktgt ... /rc4:<ntlm-hash> /ptt is OverPass-the-Hash (a.k.a. Pass-the-Key): it bridges Pass-the-Hash and Pass-the-Ticketby trading an NTLM hash for a real Kerberos TGT, useful once a target stops accepting NTLM outright but Kerberos is still open.

​
Linux (keytab-based)

A keytab file holds a service or user’s Kerberos key in reusable form, finding one during enumeration is equivalent to finding that account’s password.
Using an already-obtained ticket cache file directly:

​
Using a Ticket Exported from Windows (base64 round-trip)

The common path when a ticket is dumped on a Windows box (Rubeus /nowrap, Mimikatz export) and needs to be reused from a Linux attack host.

​
Converting Between Ticket Formats

Windows tools expect .kirbi, Linux tooling expects a ccache file, converting between them is routine when pivoting between different OS.

​
Quick Reference Tools

Pass-the-Hash

The NTLM-hash equivalent, for services that still accept NTLM.

Kerberos Double Hop Problem

Why a ticket that works for the first hop can still fail on a second one.

Rubeus

The primary Windows-side Kerberos ticket toolkit used throughout this page.

Mimikatz

The primary Windows-side Kerberos ticket toolkit used throughout this page.