Kerberos:

Lateral Movement

Reuse ccache files and keytabs on Linux to move laterally in AD

1 guide • Created Dec 28, 2025 • Updated Mar 29, 2026

1 guide

Kerberos Ticket Reuse from Linux

Exploiting cached Kerberos tickets on Linux via ccache files and keytabs to authenticate as other users and move laterally across AD environments.

Mar 16, 2026 • 5 min read

Kerberos lateral movement leverages obtained tickets and keying material to access other systems in the domain. This includes pass-the-ticket attacks, stealing ccache files from compromised hosts, reusing keytabs found on disk, and converting between ticket formats for cross-tool compatibility.

The subpages detail each technique for moving laterally through a Kerberos-authenticated environment without triggering password-based detection.