6.3.6 Inspect Kerberos tickets and compatible use
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
Access to the current logon session's ticket cache, or an explicitly obtained ticket file. Other LUIDs typically need elevation.
Where to look: Inspect client identity/realm, server SPN, start/end/renewal times, ticket type and file format. Identify which process/logon session or ccache actually uses the ticket.
Expected behavior / secure boundary: TGTs and service tickets in an authenticated session are ordinary. A ticket does not reveal a password, grant local administrator rights or authorize every service. The local process identity can differ from its network Kerberos identity.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.6.1 Baseline — Windows command prompt
Run: Windows. Requires: Current cache for ordinary inspection; session-wide enumeration can need elevation. Effect: Reads ticket metadata; does not purge or import tickets.
klist
klist tgt
klist sessions
What this checks: klist inventories cache metadata. TGTs address krbtgt/REALM; a cifs/HOST or HTTP/HOST ticket targets a specific service. sessions enumeration can need extra rights. Do not purge a cache while diagnosing it.
6.3.6.2 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Client: analyst @ EXAMPLE.TEST
Server: cifs/FS01.example.test @ EXAMPLE.TEST
End Time: already expired
Another ticket: krbtgt/EXAMPLE.TEST
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| cifs/FS01 | An SMB service-scoped ticket. | Use a compatible client and matching hostname/SPN; check authorization separately. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Expired End Time | This ticket is outside its validity window. | Obtain a legitimate current ticket/context; importing it does not repair expiry. | §6.3.6.1 — Inspect Kerberos tickets and compatible use |
| krbtgt/EXAMPLE.TEST | A TGT, not a universal service ticket. | Check KDC connectivity, realm and downstream service-ticket requests. | §6.1.1.1 — Establish the current identity and domain |
Stop when: Client, realm, SPN, validity and selected cache/logon context are understood.
Revisit only when: Ticket validity, cache context, hostname or represented identity changes.
6.3.6.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Identity, validity, SPN and client cache context match: test the intended service authorization. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Ruled out in this context | Wrong SPN, expired ticket or incompatible file format: rule out that attempted use until corrected. | §6.3.6.1 — Inspect Kerberos tickets and compatible use |
| Inconclusive / failed check | Ticket loaded but service fails: separate DNS/time, authentication and endpoint rights. | §6.5.1.1 — Diagnose the failed boundary |
6.3.6.4 Tooling and complete procedure
Windows klist is the first inspection tool; Linux klist uses the selected ccache. Rubeus/Impacket converters and key-to-ticket variants are in the linked complete procedure. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.