Active › Module 3 › Lesson 1
Tickets Named
Kerberos tickets name proof-of-identity artifacts — recognize ticket classes on $LAB_AD; defenders monitor anomalous requests.
Visual · t25_tickets_named
Ticket literacy. $LAB_AD only. Original Cyberlium.
Opening
AD auth speaks Kerberos tickets — naming them is step one before any abuse class.
Kerberos issues tickets instead of sending passwords repeatedly. Clients obtain tickets from Key Distribution Centers (KDCs) on domain controllers. Ticket classes include TGT (Ticket-Granting Ticket) and service tickets (TGS) — each has lifetime, encryption type, and service binding. Cyberlium names ticket types on YOUR $LAB_AD with defender monitoring context — not forging tickets against stranger domains. Next: TGS/TGT Named.
1. What a ticket carries (named)
Encrypted proof of authentication, session key material, timestamps, and service principal name for service tickets. Lifetime and renewability are policy-controlled — short lifetimes reduce stolen-ticket window.
On $LAB_AD, note default ticket lifetime from lab GPO or course doc — observation literacy, not ticket theft.
Command guide
Try these commands — What a ticket carries (named)
═══ WINDOWS / POWERSHELL (Active Directory Lab) ═══
Check current user, domain context, and security privileges
Command — copy this
whoami /user /groups /priv
Query active Domain Controller and trust relationships
Command — copy this
nltest /dsgetdc:$env:USERDOMAIN nltest /domain_trusts
List password policy across the domain
Command — copy this
net accounts /domain
Check Kerberos ticket cache
Command — copy this
klist
═══ LINUX / BASH (Lab Network) ═══ Test DNS SRV resolution for Active Directory services
Command — copy this
dig _ldap._tcp.dc._msdcs.lab.local SRV +short dig _kerberos._tcp.dc._msdcs.lab.local SRV +short
Primary tools to practice this lesson: curl, python3. Reference sites: Kerberos overview (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview); MITRE Kerberos (https://attack.mitre.org/techniques/T1558/); adsecurity.org Kerberos (https://adsecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. KDC role (named)
Domain controllers run KDC service — AS-REQ/AS-REP for initial auth, TGS-REQ/TGS-REP for service access. Port 88/tcp and udp for Kerberos; defenders correlate 4768/4769 events.
Literacy: KDC is identity gatekeeper — protect Tier 0 DCs, monitor auth volume anomalies.
3. Literacy supports detection — not forgery cookbooks
Forbidden: golden/silver ticket construction recipes on production. Allowed: ticket type table with defender event IDs and lifetime policy note on $LAB_AD.
Ship: ticket card — TGT vs service ticket, KDC role, one monitoring sentence. Next: TGS/TGT Named.
4. What you ship: Kerberos ticket card for $LAB_AD
Ticket type definitions, KDC role, lifetime note. $LAB_AD named. NO forgery recipes. chmod 600.
5. What you record before the next lesson
Date. Ticket card. $LAB_AD named. File t25-m03-l01-tickets-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Forge golden tickets on production. Skip ticket naming and jump to Rubeus commands.
Right
Write ticket card with defender monitoring notes for YOUR $LAB_AD. Next: TGS/TGT Named.
Mission: name Kerberos tickets
1) Define ticket in one sentence. 2) Name KDC role. 3) Note one event ID defenders watch. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
4768/4769 literacy beats memorizing roast syntax.
Knowledge Check
APPLY: Ticket literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: KDC runs on domain controllers.
True or False
Knowledge Check
APPLY: Kerberos port commonly used is:
Multiple choice