Kerberos:
Lateral Movement
Reuse ccache files and keytabs on Linux to move laterally in AD
1 guide
•
Created Dec 28, 2025
•
Updated Mar 29, 2026
Kerberos Ticket Reuse from Linux
Exploiting cached Kerberos tickets on Linux via ccache files and keytabs to authenticate as other users and move laterally across AD environments.
Kerberos lateral movement leverages obtained tickets and keying material to access other systems in the domain. This includes pass-the-ticket attacks, stealing ccache files from compromised hosts, reusing keytabs found on disk, and converting between ticket formats for cross-tool compatibility.
The subpages detail each technique for moving laterally through a Kerberos-authenticated environment without triggering password-based detection.