Impacket-ticketConverter

NEW

CollectionDefense Evasion LinuxActiveDirectoryWindows

Impacket ticketConverter.py converts between the .kirbi format (used by Mimikatz and Rubeus) and the .ccache format (used by Impacket and MIT Kerberos), in either direction, based on the input file extension. This bridges Windows and Linux tooling: dump a TGT with Rubeus, convert it, and reuse it from an Impacket workflow (or vice versa). It performs no network activity. Command Reference: Input ticket: ticket.kirbi Output ticket: out.ccache

# kirbi -> ccache (for Impacket)
ticketConverter.py ticket.kirbi out.ccache

# ccache -> kirbi (for Rubeus/Mimikatz)
ticketConverter.py out.ccache ticket.kirbi

Native: Collection, Defense Evasion
Requires: TGT
Services: Kerberos
Refs: github.com/fortra/impacket
book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket
www.thehacker.recipes/ad/movement/kerberos/ptt