Pass the Ticket
https://attack.mitre.org/techniques/T1550/003/
Last updated
Was this helpful?
https://attack.mitre.org/techniques/T1550/003/
Last updated
Was this helpful?
ATT&CK ID:
Permissions Required: Administrator | User
Description
Adversaries may "pass the ticket" using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
When preforming PtT, valid Kerberos tickets for Valid Accounts are captured by OS Credential Dumping. A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.
A Silver Ticket can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).
A Golden Ticket can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.
Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. Pass the Hash) while also using the password hash to create a valid Kerberos ticket.
A scenario is shown further down this document in order to expand on the techniques shown below.
Github (Binary):
Github (PowerShell):
Description
In the following scenario we have gained access to the member server Srv01.security.local. Here, we are looking for opportunities to escalate privilege and move laterally in the environment.
We are currently running in the context of a local administrator account on Srv01.security.local and will be using Rubeus to collect Kerberos tickets.
Collection
Whilst monitoring for incoming tickets the Domain Administrator (Moe) connects to Srv01 over RDP. During this process Moe's Kerberos ticket is stored on Srv01 and collected by Rubeus.
Rubeus can then be used to inject the ticket into the current session.
Exploitation
After a successful import we can then run PsExec and execute in the context of Moe on the Domain Controller DC01.Security.local.
We now have a command shell to the Domain Controller whilst working as the Domain Administrator.
Note: This section is a continuation on the above scenario.
Kerberos tickets extracted from Windows needs to be converted to .Ccache format for use within Linux.
Export the ticket to the Kerberos environmental variable:
Once exported we can use impacket with the -k and -no-pass parameter to execute commands on the target Domain Controller.
To contain the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it. For each domain, change the KRBTGT account password once, force replication, and then change the password a second time. Consider rotating the KRBTGT account password every 180 days.
GitHub (Binary):
GitHub (PowerShell):
GitHub:
How To Attack Kerberos 101:
