Pass The Ticket(Ptt)
Pass the Ticket(Ptt) is a credential theft technique that enables adversaries to use stolen Kerberos tickets to authenticate to resources (e.g., file shares and other computers) as a user without having to compromise that user’s password.
Exploitation
To execute a pass the hash ticket, we need to first obtain the kerberos TGT of the target user using any kind of techniques. In this case we have the kerberos TGT of an administrator, so we are going to execute ptt attack using mimikatz.
As you can see, we have successfully passed the ticket of the administrator. We can now access the powershell session of the domain controller by executing enter-pssession [dc].
