skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

conducting-pass-the-ticket-attack

Extracts and injects stolen Kerberos tickets to perform lateral movement in authorized security tests.

1|1|Updated Apr 3, 2026
Search Tags:#red team#lateral movement#mimikatz#kerberos#active directory#mitre attack#pass-the-ticket
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill conducting-pass-the-ticket-attack-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-pass-the-ticket-attack
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/infra/conducting-pass-the-ticket-attack
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill conducting-pass-the-ticket-attack-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? During authorized red team engagements, testers need a structured way to demonstrate lateral movement via Kerberos ticket theft without knowing user passwords, and this Skill provides the exact workflow, tooling, and detection context to do it safely. ## Core Features & Use Cases - Three-Phase Workflow: Guides ticket extraction from LSASS memory, ticket injection into an attacker session, and lateral movement to remote systems. - Tool Command Reference: Maps Mimikatz, Rubeus, and Impacket utilities to each phase with concrete commands like kerberos::ptt and ticketConverter.py. - MITRE ATT&CK and Detection Mapping: Links the technique to T1550.003, T1003.001, T1558, and T1021.002 plus Event IDs 4768/4769 for blue-team validation. - Use Case: After compromising a workstation in a lab environment, dump a Domain Admin TGT with Rubeus, inject it into your session, and access a file server over SMB to prove lateral movement impact for the engagement report. ## Quick Start Ask the agent to walk you through conducting a pass-the-ticket attack in your authorized lab environment, starting with ticket extraction using Mimikatz or Rubeus.

Frequently Asked Questions about conducting-pass-the-ticket-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a pass-the-ticket attack with Mimikatz?▼

Pass-the-ticket with Mimikatz uses sekurlsa::tickets /export to dump Kerberos tickets from LSASS memory, then kerberos::ptt to inject a stolen .kirbi ticket into your session. Once injected, you can access remote services as the ticket's owner without knowing their password.

What is the difference between Rubeus and Mimikatz for ticket dumping?▼

Rubeus dumps tickets in base64 format using its dump and tgtdeleg commands and runs as a C# binary, while Mimikatz exports .kirbi files directly from LSASS. Impacket's ticketConverter.py converts between .kirbi and .ccache formats for cross-tool use.

Which MITRE ATT&CK techniques does pass-the-ticket map to?▼

Pass-the-ticket maps to T1550.003 (Use Alternate Authentication Material: Pass the Ticket), with related techniques T1003.001 (LSASS Memory dumping), T1558 (Steal or Forge Kerberos Tickets), and T1021.002 (SMB/Windows Admin Shares) for the lateral movement phase.

How can defenders detect pass-the-ticket attacks?▼

Detection focuses on Event ID 4768 with unusual client addresses, Event ID 4769 service ticket requests from unexpected hosts, and TGTs used from a different IP than the one they were issued to. Multiple authentications from the same ticket across different workstations is another strong indicator.

What access is required before extracting Kerberos tickets?▼

You need local administrator access on the target workstation to read LSASS memory where Kerberos tickets are cached. The skill also requires an authorized test or lab environment and Python 3.8+ for supporting Impacket tooling.

Related Skills

Explore More Software Engineering Skills→
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced
aleister1102aleister1102

active-directory-attacks

Simulate authorized Active Directory attacks for red-team security assessments.

Community
Advanced
xalgordxalgord
954

detecting-pass-the-ticket-attacks

Detect Kerberos Pass-the-Ticket attacks by correlating Windows Event IDs 4768, 4769, and 4771 in SIEM platforms.

Community
Intermediate
blacklanternsecurityblacklanternsecurity
253

pass-the-hash

Authenticate to Active Directory services using stolen NTLM hashes, AES keys, or Kerberos tickets.

Official
Advanced