Classify tickets and use a compatible cache

Needs: Correct principal/realm, valid lifetime, service scope, compatible cache format and naming/KDC route

Inspect before use

# Inspect before use
klist
KRB5CCNAME=TICKET.ccache klist
impacket-ticketConverter TICKET.kirbi TICKET.ccache

# Compatible client example
export KRB5CCNAME=TICKET.ccache
impacket-wmiexec -k -no-pass 'DOMAIN/USER@HOST.DOMAIN'

Verify → Inspect principal, ticket service, realm and lifetime, then verify the actual service action.

If it fails → Expired tickets, wrong hostname/SPN, cache format and time skew require different fixes; an IP-only connection can break correct Kerberos naming. More detail ↓

If → then

A valid ticket/cache or a long-term key that can request a TGT → Inventory, convert and import tickets in the correct logon context
Needs: Matching client/realm/service, valid lifetime, compatible format and available KDC/service routes; ticket import affects a specific context
A password, actual NT hash, AES/NT long-term key or ticket is available → Select password, NT hash, key-to-ticket or ticket authentication
Needs: Credential type accepted by the chosen protocol/client, correct identity/domain, naming/time and destination authorization
An IP connection works while hostname/Kerberos access fails → Preserve DNS, Kerberos names and time across a pivot
Needs: Reachable correct resolver/KDC path, matching target SPN/hostname, realm configuration and acceptable time

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Classify tickets and use a compatible cache

USE WHEN: A ccache/kirbi file or an existing ticket cache
STARTING ACCESS: A credential artifact with a recorded source and possible account context
RESULT: A verified Kerberos authentication capability for an appropriate service

Recognize the clue

Inspect an existing ticket/cache before collecting new material; identify its client, service, realm and validity.

klist -c FILE

SYNTHETIC EXAMPLE OUTPUT

Default principal: USER@REALM
Service principal: cifs/TARGET_HOST@REALM
No krbtgt ticket listed

Means: This is service-scoped CIFS material, not a TGT for requesting arbitrary services.

Confirm: Check lifetime, cache format, exact SPN/name, route and destination object authorization.

After validation: The matching SMB service accepts the ticket and allowed operation: use that scoped capability.
Ruled out in this context: A CIFS-only ticket does not enable a WinRM-specific authentication path.
Still inconclusive: An unreadable/expired cache or unknown principal requires inspection/conversion rather than guessed reuse.

Troubleshooting: Expired tickets, wrong hostname/SPN, cache format and time skew require different fixes; an IP-only connection can break correct Kerberos naming.

Inspect before use:

Compatible client example:

Verify client principal, realm, TGT versus service ticket, SPN, start/end time, clock, DNS/FQDN and routes. A readable cache does not prove authorization. Roasting, forging and detailed PtT/overpass belong to the AD procedures.

Why it works

A TGT can request service tickets; a TGS is scoped to a service/SPN. A ticket for CIFS cannot simply be used as a WinRM credential.

Worked example · hypothetical

Observation: a cache contains a CIFS ticket but no TGT. Test: inspect client/server principals and lifetime. Illustrative output: the target CIFS SPN matches. Interpretation: choose a compatible SMB client, not an arbitrary remote service.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗