domains / families / security / conducting-pass-the-ticket-attack

conducting-pass-the-ticket-attack

separate

Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse.

When to use

• When conducting security assessments that involve conducting pass the ticket attack
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

When not to use

• unauthorized use against systems you do not own or have written permission to test

Skill page

Source