Kerberos Ticket Theft and Pass-the-Ticket

Use a previously obtained Kerberos TGT or service ticket as alternate authentication material: identify cached tickets, export accessible tickets, and inject a valid ticket into a Windows logon session to authenticate as the ticket identity without its password. A TGT can request service tickets for resources the account may access; a service ticket is limited to its service. Ticket injection alone does not prove successful authorization or resource access. This record covers Kerberos pass-the-ticket only; browser-cookie reuse and Windows access-token impersonation are separate procedures.