📖 What is Pass-the-Ticket (PtT)?
Pass-the-Ticket (PtT) is a technique where an attacker steals a Kerberos ticket from memory and uses it to authenticate to a service without needing the user's password. This bypasses the need for the initial authentication process.
"PtT is similar to Pass-the-Hash, but it uses Kerberos tickets (TGTs or TGSs) instead of NTLM hashes."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Pass-the-Ticket (PtT)?
- ▸ Focuses on stealing Kerberos Ticket Granting Tickets (TGTs) or Service Tickets (TGSs) from memory to impersonate users across a domain.
- ▸ Targets the Local Security Authority Subsystem Service (LSASS) process, where Windows stores authentication tickets for active user sessions.
- ▸ Allows for lateral movement by using a stolen TGT to request access to various network resources without knowing the password.
- ▸ Distinguished from Pass-the-Hash by using the Kerberos protocol's ticketing system rather than NTLM or LM password hashes.
- ▸ Can be extended into 'Golden Ticket' attacks if the KRBTGT account is compromised, granting the attacker total domain control.
🎯 How does Pass-the-Ticket (PtT) appear on the PT0-002 Exam?
A scenario might describe an attacker who has gained local administrative access to a workstation and uses a tool like Mimikatz to extract Kerberos tickets from LSASS memory to impersonate a domain user.
You may be asked to identify the specific attack technique when an adversary leverages a stolen Ticket Granting Ticket (TGT) to request access to multiple server resources without ever knowing the user's password.
Expect questions that require you to distinguish between Pass-the-Ticket and Pass-the-Hash based on whether the attacker is utilizing Kerberos tickets or NTLM hashes to authenticate to a remote system.
❓ Frequently Asked Questions
How does Pass-the-Ticket differ from Pass-the-Hash in a real-world penetration test?
Pass-the-Hash relies on NTLM hashes, which are static. Pass-the-Ticket uses Kerberos tickets, which are time-limited but allow the attacker to request access to multiple different services using a single TGT.
What is the most effective way to mitigate PtT attacks on modern Windows systems?
Enabling Windows Defender Credential Guard is the primary defense. It uses virtualization-based security to isolate the LSASS process, preventing attackers from extracting tickets even if they have administrative rights.