Overview[1]#

Pass-the-ticket (PtT) is an Authentication Method using Kerberos tickets without having access to an account's password.

Pass-the-ticket is a Kerberos Forged Ticket Attack.

Kerberos authentication can be used as the first step to lateral movement to a remote system.

In this technique, valid Kerberos tickets for Legitimate Credentials are captured by Credential Dumping. A user's Service Tickets or Ticket Granting Ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.

Silver Tickets can be obtained for services that use Kerberos Authentication Method and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).2

Golden Tickets can be obtained for the AD DOMAIN using the KRBTGT account NTLM hash, which enables generation of TGTs for any account in Microsoft Active Directory

More Information#

There might be more information for this subject on one of the following:

Add new attachment

Only authorized users are allowed to upload new attachments.
« This page (revision-3) was last changed on 21-Jun-2017 11:55 by jim