Conducting Pass-the-Ticket Attack
FreeExecute lateral movement using stolen Kerberos tickets.
Free · Opens the source repo
What Conducting Pass-the-Ticket Attack does
The Conducting Pass-the-Ticket Attack skill enables security professionals to perform lateral movement within a network by leveraging stolen Kerberos tickets. This technique is particularly useful for red team assessments and authorized penetration testing, allowing users to extract Ticket Granting Tickets (TGT) or Ticket Granting Service tickets (TGS) from the Local Security Authority Subsystem Service (LSASS) memory on a compromised host. Once extracted, these tickets can be injected into a session to impersonate the ticket owner, gaining access to resources without needing their password.
This skill is designed for users who are familiar with red teaming concepts and require a practical tool for simulating real-world attack scenarios. It provides a structured workflow for ticket extraction, injection, and lateral movement, ensuring that users can effectively demonstrate the potential impact of Kerberos ticket theft in their security assessments. The skill also includes validation criteria to help users confirm successful execution and document findings for reporting.
The skill is built with Python, requiring Python 3.8 or higher and specific dependencies for execution. It is essential to have appropriate authorization and a safe testing environment to utilize this skill, as unauthorized use can lead to legal repercussions. This tool is particularly relevant for security assessments, incident response, and validating security controls against Kerberos ticket theft.
In addition to the practical execution of the attack, the skill maps to several MITRE ATT&CK techniques, providing users with a clear understanding of how this attack fits within the broader context of cybersecurity threats. By using this skill, security professionals can enhance their capabilities in identifying and mitigating risks associated with Kerberos ticket exploitation.
When to use it
Use this skill during red team exercises, security assessments, or incident response scenarios where Kerberos ticket exploitation is relevant.
When not to use it
This skill is not suitable for environments where unauthorized testing is prohibited or where there is no clear authorization for security assessments.
What you can build with it
Security Assessments
Use this skill during security assessments to simulate Kerberos ticket exploitation and evaluate defenses.
Incident Response
Employ the skill to validate detections and responses to Kerberos ticket theft incidents.
Training and Education
Utilize this skill in educational settings to teach red teaming techniques and Kerberos exploitation.
How to install Conducting Pass-the-Ticket Attack
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/conducting-pass-the-ticket-attack --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Conducting Pass-the-Ticket Attack
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Overview
Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets from memory (LSASS) on a compromised host, an attacker can inject those tickets into their own session to impersonate the ticket owner and access resources as that user.
When to Use
- When conducting security assessments that involve conducting pass the ticket attack
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
MITRE ATT&CK Mapping
- T1550.003 - Use Alternate Authentication Material: Pass the Ticket
- T1003.001 - OS Credential Dumping: LSASS Memory
- T1558 - Steal or Forge Kerberos Tickets
- T1021.002 - Remote Services: SMB/Windows Admin Shares
Workflow
Phase 1: Ticket Extraction
- Gain local admin access on target workstation
- Dump Kerberos tickets from LSASS memory using Mimikatz or Rubeus
- Export tickets in .kirbi format (Mimikatz) or base64 (Rubeus)
- Identify high-value tickets (Domain Admin TGTs, service tickets to critical systems)
Phase 2: Ticket Injection
- Purge existing Kerberos tickets from attacker session
- Import/inject stolen ticket into current session
- Verify ticket is loaded and valid
- Access target resources using injected ticket
Phase 3: Lateral Movement
- Access remote systems using the stolen ticket identity
- Perform actions as the impersonated user
- Collect additional credentials from accessed systems
- Document evidence of successful lateral movement
Tools and Resources
| Tool | Purpose | Command |
|---|---|---|
| Mimikatz | Ticket export/import | sekurlsa::tickets /export, kerberos::ptt |
| Rubeus | Ticket dumping and injection | dump, ptt, tgtdeleg |
| Impacket ticketConverter | Convert between formats | ticketConverter.py ticket.kirbi ticket.ccache |
| Impacket psexec/smbexec | Remote execution with ticket | KRB5CCNAME=ticket.ccache psexec.py |
Detection Indicators
- Event ID 4768 with unusual client addresses
- Event ID 4769 service ticket requests from unexpected hosts
- TGT usage from different IP than the TGT was issued to
- Multiple authentications from same ticket across different workstations
Validation Criteria
- Kerberos tickets extracted from compromised host
- Tickets injected into attacker session
- Lateral movement demonstrated using stolen tickets
- Evidence captured for reporting
Frequently asked questions about Conducting Pass-the-Ticket Attack
Similar skills
Cloudflare Security Audit
Perform authorized security audits on codebases.
Authenticated Scan with OpenVAS
Perform deep vulnerability scans using OpenVAS with credentials.
Active Directory Penetration Test
Conduct focused AD penetration tests with ease.
Active Directory BloodHound Analysis
Visualize Active Directory attack paths and risks.
Orchestrating LLM Attacks with PyRIT
Automate multi-turn adversarial attacks against LLMs.
Operating Sliver C2
Deploy and manage Sliver C2 for red-team engagements.