Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 03. Kerberos / Tickets

Information

Kerberos tooling uses different ticket formats depending on the operating system and toolchain. Windows tooling usually works with .kirbi tickets or base64 KRB-CRED blobs. Linux tooling usually works with MIT Kerberos ccache files through KRB5CCNAME.

The conversion workflow is straightforward:

Windows ticket material -> kirbi -> ccache -> Linux Kerberos tooling
Linux ccache -> kirbi -> Windows ticket injection
password / NTLM / AES / certificate -> TGT -> ccache or kirbi

Common tools:

Core Linux environment variable:

export KRB5CCNAME=FILE:$(pwd)/ticket.ccache
klist

Core Windows ticket injection:

.\Rubeus.exe ptt /ticket:ticket.kirbi
klist

The ticket format does not change what the ticket is for. A cifs/dc01.ootw.local ticket converted from .kirbi to .ccache is still only useful for CIFS/SMB. Conversion changes the container, not the SPN, identity, lifetime, encryption type, or privileges.