refactor(payload): rename apollo to ares and update documentation

This commit renames the Apollo payload type to Ares, moving all associated files and updating documentation accordingly. The change includes:
- Renaming directories from `apollo` to `ares`
- Updating documentation image references
- Maintaining the same code functionality while changing the payload name
- Adding new Ares-specific documentation files
- Removing old Apollo documentation files

The rename is done to reflect the new payload name while preserving all existing functionality.
This commit is contained in:
Aryma
2026-04-14 14:02:44 +07:00
parent e14b1f21eb
commit 03d283cf49
753 changed files with 0 additions and 0 deletions

View File

@@ -0,0 +1,39 @@
+++
title = "ticket_cache_extract"
chapter = false
weight = 103
hidden = false
+++
{{% notice info %}}
Artifacts Generated: WindowsAPIInvoke
{{% /notice %}}
## Summary
Extract the specified ticket(s) from the current logon session, this uses LSA APIs to extract a ticket from the active logon session on the host.
This includes all details and a base64 encoded copy of the ticket.
If ran from an elevated context this also can get a ticket from any session.
### Arguments
#### luid
Optional argument to extract a ticket from the cache of a different logon session, must be elevated.
#### Service
The name of the service to taget for example krbtgt for tgt, or one of the various service ticket types (ex. cifs, host, ldap, etc.)
## Usage
```
ticket_cache_extract -luid [luidValue] -service [service]
```
Example
```
ticket_cache_extract -luid 0xabcd -service cifs
ticket_cache_extract -service krbtgt
```
## MITRE ATT&CK Mapping
- T1550