ryuki's blog

ryuki's blog

root

/

tags

/

Steal or Forge Kerberos Tickets (T1558)

Steal or Forge Kerberos Tickets (T1558)

Jan 01, 19701 min read

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.

Tactics
TA0006

Sub-techniques
T1558.001 T1558.002 T1558.003 T1558.004


See: MITRE ATT&CK

6 items with this tag.

  • Nov 22, 2025

    Mirage

    • hackthebox
    • hard
    • windows
    • dns
    • nats
    • esc10
    • adcs
    • gmsa
    • kerberoast
    • T1078
    • T1078.002
    • T1078.003
    • T1098
    • T1098.007
    • T1110
    • T1110.002
    • T1187
    • T1550
    • T1550.002
    • T1550.003
    • T1557
    • T1558
    • T1558.003
  • Oct 18, 2025

    DarkCorp

    • hackthebox
    • insane
    • windows
    • sql-injection
    • phishing
    • ntlmrelayx
    • krbrelayx
    • esc8
    • adcs
    • dns
    • ntlm
    • gpo
    • dpapi
    • mail
    • pygpoabuse
    • SharpDPAPI
    • roundcube
    • T1003
    • T1003.005
    • T1078
    • T1078.002
    • T1078.003
    • T1098
    • T1098.007
    • T1110
    • T1110.002
    • T1110.003
    • T1187
    • T1190
    • T1550
    • T1550.002
    • T1550.003
    • T1552
    • T1552.001
    • T1555
    • T1555.005
    • T1558
    • T1558.002
    • T1566
  • Apr 19, 2025

    Administrator

    • hackthebox
    • windows
    • medium
    • kerberoast
    • targeted-kerberoast
    • dcsync
    • ftp
    • pwsafe
    • T1003
    • T1003.006
    • T1078
    • T1078.002
    • T1098
    • T1110
    • T1110.002
    • T1555
    • T1555.004
    • T1558
    • T1558.003
  • Apr 05, 2025

    Ghost

    • hackthebox
    • ctf
    • windows
    • insane
    • gitea
    • ldap-injection
    • goldensaml
    • SigmaPotato
    • sliver
    • amsi
    • adfs
    • gmsa
    • saml
    • mssql
    • linked-database
    • T1003
    • T1059
    • T1068
    • T1078
    • T1110
    • T1190
    • T1550
    • T1552
    • T1558
    • T1562
    • T1562.001
    • T1606
  • Nov 09, 2024

    Blazorized

    • hackthebox
    • ctf
    • windows
    • hard
    • blazor
    • web-assembly
    • script-path
    • kerberoasting
    • dcsync
    • jwt
    • dnspy
    • dll
    • T1078
    • T1078.002
    • T1098
    • T1110
    • T1110.002
    • T1558
    • T1558.003
    • T1606
    • T1606.001
  • Oct 26, 2024

    Mist

    • hackthebox
    • ctf
    • windows
    • insane
    • adcs
    • ecs13
    • pluckcms
    • lnk
    • petitpotam
    • coerce
    • webdav
    • ntlmrelayx
    • certify
    • rubeus
    • shadow-credentials
    • mask
    • hashcat
    • oid-group-link
    • backup-operators
    • T1003
    • T1003.002
    • T1003.006
    • T1078
    • T1078.002
    • T1098
    • T1110
    • T1110.002
    • T1187
    • T1190
    • T1555
    • T1555.005
    • T1558
    • T1558.002

Created with ❤️ and Quartz

  • Mastodon
  • Bluesky
  • GitHub