If we compromise an active user’s shell session, we can essentially act as the user in question and use their current Kerberos tickets. Gaining an initial TGT would require the user’s Active Directory password. However, if the user is already authenticated, we can just use their current tickets.
A user’s ccache file is stored in /tmp with a format like /tmp/krb5cc_
The file is typically only accessible by the owner. Because of this, it’s unlikely that we will be able to steal a user’s ccache file as an unprivileged user.
Note that even as root you may not be able to access other users cache files in /tmp
ls -al /tmp/krb5cc_*
/tmp/krb5cc_607000500_3aeIA5
copy the domain administrator’s ccache file and set the ownership of the new file to our offsec user.
