A Kerberos ticket is a token used for authentication that records various information (user information, SPN, permissions and privileges, timestamps, TTL, etc) encrypted with either the KDC (for TGT) or a service’s (for TGS) secret key.
To list tickets cached in memory, run klist
.
When exported using tools, tickets come with a .kirbi
extension for Rubeus and .ccache
for impacket.