pass-the-ticket

5. Pass the ticket similar to Pass The Key steals ticket instead of requesting ticket via known hash in Linux, tickets are stored in credential caches (ccache) 3 main locations: files, /tmp/krb5cc_%{uid} (default) Kernel Keyrings - specail space in Linux kernel for storing keys process memory - used when only one process needs to use the ticket in Windows, tickets are handled and stored by the LSASS (Local Security Authority Subsystem Service) process responsible for security....