Pass-the-ticket and overpass-the-hash

Kerberos uses tickets: the TGT proves your identity to the KDC, TGS tickets grant access to services. Stealing a ticket from memory (or forging one) equals impersonating the user.

The variants

Pass-the-ticket: extract a TGT/TGS from a compromised machine's memory and inject it into your session.

Overpass-the-hash: with a user's NT hash (or AES key), request a legitimate TGT from the KDC — turning a hash into a full Kerberos ticket.

sekurlsa::tickets /export         # dump tickets
kerberos::ptt ticket.kirbi        # inject
sekurlsa::pth /user:.. /ntlm:.. /run:cmd   # overpass

Defence

LSASS protection (Credential Guard), sensitive accounts with AES and non-delegable, short ticket lifetimes, Kerberos event monitoring. Admin tiering limits where a privileged ticket can be stolen from.