Pass-the-Ticket (PtT)

Pass-the-Ticket (PtT) reuses a valid Kerberos ticket to authenticate to a remote service. This record shows two ways to obtain a TGT and use Kerberos: Rubeus can request a TGT with an account NT hash and submit it to the current Windows logon session, while Impacket can save a hash-derived TGT to a ccache for later SMB authentication. The NT hash is used as Kerberos key material rather than sent as an NTLM challenge response. Ticket acquisition or import alone does not establish access; the ticket must be valid for the target service and its principal must have the required rights.