CatalogWADComs

WAD · Tool

Impacket-ticketConverter

1 techniqueLinux · ActiveDirectory · WindowsWADComsGPL-3.0

Impacket-TicketConverter

DÆMON
CollectionDefense EvasionLinuxActiveDirectoryWindows

Impacket ticketConverter.py converts between the .kirbi format (used by Mimikatz and Rubeus) and the .ccache format (used by Impacket and MIT Kerberos), in either direction, based on the input file extension. This bridges Windows and Linux tooling: dump a TGT with Rubeus, convert it, and reuse it from an Impacket workflow (or vice versa). It performs no network activity. Command Reference: Input ticket: ticket.kirbi Output ticket: out.ccache

# kirbi -> ccache (for Impacket)
ticketConverter.py ticket.kirbi out.ccache

# ccache -> kirbi (for Rubeus/Mimikatz)
ticketConverter.py out.ccache ticket.kirbi
Evidence
Upstream reference
Environment
Active Directory
Native
Collection, Defense Evasion
Requires
Kerberos ticket
Services
Kerberos