@irenej looks like it's harder these days because the tickets usually get cryptographically verified and there's mutual authentication going on. Back in the days with novel netware, IIRC, you could just steal a ticket and use it and adapt it for other things, like grabbing an admin ticket and setting your own account to be admin on the domain controller, but yea again its' all been a long while so I might get details wrong ^^; it's fun to mess with though! many things rely on network integrity