Command Manager

Rubeus ptt (Pass-the-Ticket)

Inject a Kerberos ticket into the current logon session. Accepts base64 from asktgt/s4u output or a .kirbi file from disk. After injection, native Windows tooling (klist, dir \\target\c$) just works.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
Rubeus.exe
Category
Post-Exploitation / Persistence
Platform
windows
Requires
shell access
Protocols
KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

Rubeus.exe ptt /ticket:<base64-or-kirbi-path>

Credential variants

The same attack using a different authentication material.

Specific LUID requires local admin

Rubeus.exe ptt /ticket:<ticket> /luid:0x<luid>

Examples

Rubeus.exe ptt /ticket:doIFvjCC...

Tags

rubeus ptt pass-the-ticket