Ticket/Hash Attacks

Exporting Tickets

Mimikatz

sekurlsa::tickets /export
or if don't work try
sekurlsa::ekeys

The tickets ending with a $ symbol represent the computer account, which requires a ticket to communicate with the AD. User tickets, on the other hand, include the user's name, followed by an @ symbol that separates the service name and the domain. For example: [randomvalue]-username@service-domain.local.kirbi.

Rubeus

Rubeus.exe dump /nowrap

Last updated