ryuki's blog

            • Corporate
            • FormulaX
            • Headless
            • Jab
            • Mist
            • Office
            • Perfection
            • Skyfall
            • WifineticTwo
            • Axlle
            • Blazorized
            • Blurry
            • BoardLight
            • Editorial
            • Freelancer
            • Ghost
            • Intuition
            • MagicGardens
            • Mailing
            • PermX
            • Runner
            • SolarLab
            • Caption
            • Chemistry
            • Cicada
            • Infiltrator
            • Instant
            • Lantern
            • MonitorsThree
            • Resource
            • Sea
            • Sightless
            • Trickster
            • University
            • Yummy
            • Backfire
            • BigBang
            • Cat
            • Checker
            • Code
            • Cypher
            • DarkCorp
            • Dog
            • EscapeTwo
            • Haze
            • TheFrizz
            • Titanic
            • Certificate
            • Fluffy
            • Puppy
            • TombWatcher
            • Administrator
            • Alert
            • BlockBlock
            • Certified
            • Compiled
            • Environment
            • Eureka
            • GreenHorn
            • Heal
            • IClean
            • LinkVortex
            • Nocturnal
            • Planning
            • Scepter
            • UnderPass
            • Usage
            • Vintage
          • Baby
          • Build
          • Down
          • Escape
      root

      /

      tags

      /

      Steal or Forge Kerberos Tickets (T1558)

      Steal or Forge Kerberos Tickets (T1558)

      Jan 01, 19701 min read

      Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.

      Tactics
      TA0006

      Sub-techniques
      T1558.001 T1558.002 T1558.003 T1558.004


      See: MITRE ATT&CK

      5 items with this tag.

      • Oct 18, 2025

        DarkCorp

        • hackthebox
        • insane
        • windows
        • sql-injection
        • phishing
        • ntlmrelayx
        • krbrelayx
        • esc8
        • adcs
        • dns
        • ntlm
        • gpo
        • dpapi
        • mail
        • pygpoabuse
        • SharpDPAPI
        • roundcube
        • T1003
        • T1003.005
        • T1078
        • T1078.002
        • T1078.003
        • T1098
        • T1098.007
        • T1110
        • T1110.002
        • T1110.003
        • T1187
        • T1190
        • T1550
        • T1550.002
        • T1550.003
        • T1552
        • T1552.001
        • T1555
        • T1555.005
        • T1558
        • T1558.002
        • T1566
      • Apr 19, 2025

        Administrator

        • hackthebox
        • windows
        • medium
        • kerberoast
        • targeted-kerberoast
        • dcsync
        • ftp
        • pwsafe
        • T1003
        • T1003.006
        • T1078
        • T1078.002
        • T1098
        • T1110
        • T1110.002
        • T1555
        • T1555.004
        • T1558
        • T1558.003
      • Apr 05, 2025

        Ghost

        • hackthebox
        • ctf
        • windows
        • insane
        • gitea
        • ldap-injection
        • goldensaml
        • SigmaPotato
        • sliver
        • amsi
        • adfs
        • gmsa
        • saml
        • mssql
        • linked-database
        • T1003
        • T1059
        • T1068
        • T1078
        • T1110
        • T1190
        • T1550
        • T1552
        • T1558
        • T1562
        • T1562.001
        • T1606
      • Nov 09, 2024

        Blazorized

        • hackthebox
        • ctf
        • windows
        • hard
        • blazor
        • web-assembly
        • script-path
        • kerberoasting
        • dcsync
        • jwt
        • dnspy
        • dll
        • T1078
        • T1078.002
        • T1098
        • T1110
        • T1110.002
        • T1558
        • T1558.003
        • T1606
        • T1606.001
      • Oct 26, 2024

        Mist

        • hackthebox
        • ctf
        • windows
        • insane
        • adcs
        • ecs13
        • pluckcms
        • lnk
        • petitpotam
        • coerce
        • webdav
        • ntlmrelayx
        • certify
        • rubeus
        • shadow-credentials
        • mask
        • hashcat
        • oid-group-link
        • backup-operators
        • T1003
        • T1003.002
        • T1003.006
        • T1078
        • T1078.002
        • T1098
        • T1110
        • T1110.002
        • T1187
        • T1190
        • T1555
        • T1555.005
        • T1558
        • T1558.002

      Recent ...

      • DarkCorp

        Oct 18, 2025

      • TombWatcher

        Oct 11, 2025

      • Certificate

        Oct 04, 2025

      • Puppy

        Sep 27, 2025

      • Season 9

        Sep 20, 2025

      Created with ❤️ and Quartz

      • Mastodon
      • Bluesky
      • GitHub