Tickets

Executes Mimikatz's kerberos::tickets on the target system.

Output for each system is stored in $pwd\PME\Tickets\MimiTickets\

As Mimikatz is highly signatured by AV, it is recommended to use the KerbDump module instead of this if tickets are required.

Supported Methods

• MSSQL

• SMB

• SessionHunter (WMI)

• WMI

• WinRM

Known Issues

Base64 tickets from output are not well formed and requires whitespaces to be removed before being used with tools such as Rubeus.

Optional Parameters

Parameter	Value	Description
-ShowOutput	N/A	Displays each targets output to the console
-SuccessOnly	N/A	Display only successful results

Usage

# Standard execution
PsMapExec -Username [User] -Password [Pass] -targets [All] -Module Tickets -Method [Method] -ShowOutput

Output file