Credentials are more than just passwords. Kerberos is more than just Windows Active Directory. This talk goes into the inner workings of macOS's Heimdal implementation of Kerberos, credential caches, keytabs, hashes, tickets, and authentication mechanisms. We will walk through how Kerberos works, how Active Directory joined macOS endpoints can be leveraged from an offensive perspective, and how defenders can start looking for these techniques. Finally, we'll do a deep dive into the LKDC - the local key distribution center located on every macOS endpoint since 10.5 and how that can be leveraged from an offensive perspective when a mac is NOT joined to an Active Directory domain. All techniques covered in the talk will be available in an open source tool called Bifrost which leverages native Kerberos APIs without the need for Python or scripting languages.