Pass-the-ticket

Pass-the-ticket is credential theft aimed at Kerberos tickets rather than passwords. Tickets live in the memory of any machine a user has authenticated from; an attacker with local access extracts them, moves them to a system they control, and presents them as their own. A stolen TGT lets the attacker request fresh service tickets as the victim; a stolen service ticket grants access to one resource until it expires.

The distinction from forging matters. Golden and silver ticket attacks create tickets from stolen key material; pass-the-ticket reuses genuine tickets the KDC really issued. That caps the attack at the victim’s actual privileges and at the ticket’s lifetime, which is why short ticket lifetimes and protections such as Credential Guard, which shields ticket material in memory, are the countermeasures worth naming.

Exam relevance: classify the attack correctly. “Stolen from memory and reused” is pass-the-ticket; “created using the KRBTGT hash” is a golden ticket; “created using a service account hash” is a silver ticket. Its NTLM cousin, pass-the-hash, replays password hashes instead of tickets and appears in the same question families.