What problem does it solve?
During authorized red team engagements, testers need a structured, repeatable method to demonstrate Pass-the-Ticket lateral movement using stolen Kerberos tickets, avoiding common pitfalls like wrong ticket formats, stale caches, and expired tickets that cause silent failures.
Core Features & Use Cases
- Three-Phase Workflow: Covers ticket extraction from LSASS memory with Mimikatz or Rubeus, ticket injection after purging existing caches, and lateral movement to remote systems.
- Pitfall Guidance: Documents frequently missed issues such as .kirbi vs .ccache format conversion with ticketConverter.py, TGT versus TGS selection, and ticket lifetime validation.
- Detection & Validation: Maps the technique to MITRE ATT&CK (T1550.003, T1003.001, T1558, T1021.002) and lists detection indicators like Event IDs 4768 and 4769 for blue team correlation.
- Use Case: A red team operator with local admin access on a compromised workstation dumps a Domain Admin TGT with Rubeus, converts and injects it, then validates access with
dir \\dc01\c$ to prove lateral movement in the engagement report.
Quick Start
Ask the AI to walk you through conducting a Pass-the-Ticket attack in your authorized lab environment, starting with extracting Kerberos tickets using Rubeus and injecting them for lateral movement.
