agentsclimarketplace

Conducting pass the ticket attack

Skill autohandai/community-skills/conducting-pass-the-ticket-attack

A collection of curated, useful, and safe skills for Autohand Code CLI Agent

Install
npx -y skills add autohandai/community-skills --skill conducting-pass-the-ticket-attack

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 9 stars9 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets fro

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, 555 tokens by cl100k_base, as published. Nobody here has run it

Conducting Pass-the-Ticket Attack

Overview

Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets from memory (LSASS) on a compromised host, an attacker can inject those tickets into their own session to impersonate the ticket owner and access resources as that user.

MITRE ATT&CK Mapping

  • T1550.003 - Use Alternate Authentication Material: Pass the Ticket
  • T1003.001 - OS Credential Dumping: LSASS Memory
  • T1558 - Steal or Forge Kerberos Tickets
  • T1021.002 - Remote Services: SMB/Windows Admin Shares

Implementation Steps

Phase 1: Ticket Extraction

  1. Gain local admin access on target workstation
  2. Dump Kerberos tickets from LSASS memory using Mimikatz or Rubeus
  3. Export tickets in .kirbi format (Mimikatz) or base64 (Rubeus)
  4. Identify high-value tickets (Domain Admin TGTs, service tickets to critical systems)

Phase 2: Ticket Injection

  1. Purge existing Kerberos tickets from attacker session
  2. Import/inject stolen ticket into current session
  3. Verify ticket is loaded and valid
  4. Access target resources using injected ticket

Phase 3: Lateral Movement

  1. Access remote systems using the stolen ticket identity
  2. Perform actions as the impersonated user
  3. Collect additional credentials from accessed systems
  4. Document evidence of successful lateral movement

Tools and Resources

ToolPurposeCommand
MimikatzTicket export/importsekurlsa::tickets /export, kerberos::ptt
RubeusTicket dumping and injectiondump, ptt, tgtdeleg
Impacket ticketConverterConvert between formatsticketConverter.py ticket.kirbi ticket.ccache
Impacket psexec/smbexecRemote execution with ticketKRB5CCNAME=ticket.ccache psexec.py

Detection Indicators

  • Event ID 4768 with unusual client addresses
  • Event ID 4769 service ticket requests from unexpected hosts
  • TGT usage from different IP than the TGT was issued to
  • Multiple authentications from same ticket across different workstations

Validation Criteria

  • Kerberos tickets extracted from compromised host
  • Tickets injected into attacker session
  • Lateral movement demonstrated using stolen tickets
  • Evidence captured for reporting

What ships with it: 7 files

34.6 KB alongside SKILL.md, 2 of them executable

assets/

references/

scripts/

Keep looking

Skills are one crate of 327,167. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.