Overview
Quickly triage all accessible Kerberos tickets across all logon sessions on the current system. This command provides a rapid overview of available tickets without extracting full ticket data, ideal for initial reconnaissance and target identification.Syntax
Optional Parameters
Target specific logon session ID
Filter by specific username
Filter by service name pattern
Examples
Triage Information
Ticket Overview
Ticket Overview
Basic Details:
- Logon session ID (LUID)
- Username and domain
- Service principal name
- Ticket type (TGT vs Service)
- Start and end times
- Encryption type
- Ticket flags
- Validity status
Session Context
Session Context
Logon Session Details:
- Authentication package
- Logon type and time
- User SID and privileges
- Session characteristics
- Available for extraction
- Requires elevation
- Cross-session visibility
- Permission requirements
Use Cases
Initial Reconnaissance
Initial Reconnaissance
System Assessment:
- Identify high-value tickets
- Map user sessions and activities
- Locate administrative accounts
- Find service account tickets
- Identify domain admin tickets
- Locate delegation-enabled accounts
- Find cross-domain tickets
- Spot unusual service tickets
Operational Planning
Operational Planning
Attack Preparation:
- Plan ticket extraction strategy
- Identify privilege escalation paths
- Map lateral movement opportunities
- Assess defensive visibility
- Focus on valuable targets
- Avoid unnecessary extractions
- Minimize detection footprint
- Streamline operations
Output Analysis
Understanding Results
Understanding Results
Sample Output:Key Elements:
- LUID identifies logon session
- Ticket ID for extraction reference
- Service name indicates access scope
- Times show validity window
Strategic Applications
High-Value Target Identification
High-Value Target Identification
Administrative Tickets:
- Domain controller access (HOST, LDAP)
- Domain admin accounts (krbtgt tickets)
- Exchange server access (exchangeab)
- SQL server access (mssql)
- Service accounts with delegation
- Machine accounts with valuable access
- Cross-domain service accounts
- Accounts with multiple service tickets
Lateral Movement Planning
Lateral Movement Planning
Access Mapping:
- Identify accessible systems via tickets
- Map service relationships
- Find trust relationships
- Locate administrative boundaries
- Choose highest-value targets
- Minimize required privilege escalation
- Identify direct access paths
- Plan multi-hop strategies
Integration Workflows
Reconnaissance to Extraction
Reconnaissance to Extraction
Complete Workflow:
Targeted Assessment
Targeted Assessment
Focused Analysis:
Session Management
Current Session
Current Session
Default Behavior:
- Shows tickets from current session
- No elevation required
- Limited to user’s context
- Safe for reconnaissance
Cross-Session Access
Cross-Session Access
Elevated Operations:
- Requires administrative privileges
- Access to all logon sessions
- System-wide ticket visibility
- Enhanced targeting capabilities
- Use logonsession command for LUID enumeration
- Target specific high-value sessions
- Cross-reference with user activities
- Plan extraction strategies
Operational Security
Detection Considerations
Detection Considerations
Low-Risk Operations:
- Triage generates minimal logs
- No ticket modification or extraction
- Standard authentication package queries
- Difficult to distinguish from normal activity
- Avoid excessive triage frequency
- Focus on specific targets when possible
- Correlate with normal system activity
- Minimize enumeration footprint
Related Commands
dump- Extract identified ticketsklist- List current session ticketslogonsession- Enumerate logon sessionsptt- Use triaged tickets