redttps

Klist to find tickets

Description

Klist is a command-line utility used to list the Kerberos tickets held in a user’s current credential cache. It displays information about the user’s Kerberos tickets, including the principal (Kerberos identity), ticket validity period, and the key distribution center (KDC) that issued the tickets.


Steps

  1. Run the command and see what tickets you have
    2. klist.exe
  2. If you find a ticket for a service like MSSQL you can dump the ticket with Rubeus dump or similar tools