Which attack involves presenting a Kerberos ticket to access services on other systems?

Which attack involves presenting a Kerberos ticket to access services on other systems?

• A. Kerberoasting
• B. Pass the Ticket Attack
• C. AS-REP Roasting
• D. LLMNR/NBT-NS Poisoning

Answer: (B)

In Kerberos, authentication is based on tickets that prove a user or service’s identity to other services. A pass-the-ticket attack happens when an attacker takes a valid Kerberos ticket from one host (a service ticket or TGS ticket obtained from a compromised system) and presents it to access services on other systems. Because the ticket is already authenticated and time-limited, the target service accepts it without requiring the attacker to re-enter credentials. This makes it a powerful way to move laterally within a network once a ticket has been captured, often using tools that export and re-inject tickets. Kerberoasting, by contrast, involves dumping and cracking service tickets to recover the service account passwords rather than using a ticket on other systems. AS-REP Roasting targets accounts that don’t use pre-authentication to obtain password data offline. LLMNR/NBT-NS Poisoning is about capturing credentials through spoofed name resolution traffic and is not specifically about presenting a Kerberos ticket to access other systems.

In Kerberos, authentication is based on tickets that prove a user or service’s identity to other services. A pass-the-ticket attack happens when an attacker takes a valid Kerberos ticket from one host (a service ticket or TGS ticket obtained from a compromised system) and presents it to access services on other systems. Because the ticket is already authenticated and time-limited, the target service accepts it without requiring the attacker to re-enter credentials. This makes it a powerful way to move laterally within a network once a ticket has been captured, often using tools that export and re-inject tickets.

Kerberoasting, by contrast, involves dumping and cracking service tickets to recover the service account passwords rather than using a ticket on other systems. AS-REP Roasting targets accounts that don’t use pre-authentication to obtain password data offline. LLMNR/NBT-NS Poisoning is about capturing credentials through spoofed name resolution traffic and is not specifically about presenting a Kerberos ticket to access other systems.