Golden Ticket
A Golden Ticket attack consist of the creating of a legitimate Ticket Granting Ticket (TGT) that impersonates any user through the use of the NTLM hash of the krbtgt account. (Unlimited Access to AD).
Golden Ticket
Golden Ticket is used for persistence. Compromising a DC is a prerequisite to perform this attack.
Once we have admin access to DC, the KRBTGT hash is extracted to sign TGT.
We can forge a TGT (Golden Ticket) by using the KRBTGT hash.
Since the Golden Ticket is encrypted and signed with the KRBTGT hash, it is seen as legitimate by other domain controllers and services.
Very noisy as we are accessing DC to extract KRBTGT credentials. To avoid detection, use accounts other than administrator and ensure you check optional arguments like startoffset, etc.
To get KRBTGT hash, execute Mimikatz on DC or DA:
Attack in Practice:
Using PowerShell Remoting and Invoke-Mimi.ps1
Start a process with DA privs in a elevated shell.
As DA, we open a session as dcorp-dc, and disable script logging and AMSI.
We can also run DCSync attack from the process runnning as DA:
Create a Golden Ticket
We can now access filesystem on DC and also get a shell:
Using Rubeus, SafetyKatz, or BetterSafetyKatz.exe
Open CMD and use ArgSplit to encode asktgt.
Open an elevated DA cmd by using DA Hash extracted previously:
Run SafetyKatz to dump KRBTGT hashes and fetch SID
Exit from mimikatz and DA shell. From Student cmd, run Rubeus to get the golden ticket. It will also output the command to forge the Golden ticket and inject it in the current process. Add /ptt at the end to inject it in the current process.
Finally, we can use winrs to login to dcorp-dc from Student.
Last updated