Pass-the-Ticket

Pass-the-Ticket (PtT) is the Kerberos analogue of pass-the-hash: an attacker steals a Ticket Granting Ticket or service ticket out of a machine’s memory — or forges one outright, as with a Golden Ticket — and injects it into a new session to authenticate as that user, no password required. It’s a core lateral-movement step in Active Directory assessments, riding the same Kerberos on port 88 exchange as Kerberoasting.

How It Works

• Dump tickets from LSASS. mimikatz’s sekurlsa::tickets or Rubeus pulls cached TGTs and service tickets straight from memory.
• Export as .kirbi. The extracted ticket is saved in a portable format ready to move to another host.
• Inject and replay. kerberos::ptt loads the ticket into a new logon session, and the target system accepts it as proof of identity.
• Overpass-the-hash (related move). Instead of stealing a ticket, an attacker with just an NTLM hash requests a fresh TGT with it — turning a hash into a ticket.
• Works because tickets are bearer tokens. Kerberos never re-checks the presenter’s identity against the ticket’s owner, so possession is enough.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

How to Detect It

• Watch for a ticket being used from a host or IP that account has never logged on from.
• Correlate 4768/4769 anomalies — a TGT or service ticket used from a location inconsistent with its issuance.
• Monitor LSASS access by non-system processes (Sysmon Event ID 10), the reliable precursor to ticket theft and reuse.

How to Defend Against It

• Enable Credential Guard to protect LSASS memory from ticket extraction in the first place.
• Set short ticket lifetimes so a stolen ticket has a narrow window of use.
• Adopt a tiered admin model so privileged tickets never land on an ordinary workstation to begin with.
• Add sensitive accounts to the Protected Users group, which blocks the credential caching that makes ticket theft possible.

Log every host you reach and the ticket you rode in on, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.