Golden Ticket with krbtgt
Last updated
Last updated
Requirement:
Env -> domain controller
This attack assumes a Domain Controller compromise where KRBTGT account hash will be extracted which is a requirement for a successful Golden Ticket attack.
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket
A Golden Ticket attack consist on the creation of a legitimate Ticket Granting Ticket (TGT) impersonating any user through the use of the NTLM hash of the Active Directory (AD) krbtgt account. This technique is particularly advantageous because it enables access to any service or machine within the domain as the impersonated user. It's crucial to remember that the krbtgt account's credentials are never automatically updated.
To acquire the NTLM hash of the krbtgt account, various methods can be employed. It can be extracted from the Local Security Authority Subsystem Service (LSASS) process or the NT Directory Services (NTDS.dit) file located on any Domain Controller (DC) within the domain. Furthermore, executing a DCsync attack is another strategy to obtain this NTLM hash, which can be performed using tools such as the lsadump::dcsync module in Mimikatz or the secretsdump.py script by Impacket. It's important to underscore that to undertake these operations, domain admin privileges or a similar level of access is typically required.
Sample extract krbtgt's account hash:
Inject golden ticket to memory:
check the ticket with klist
Once you have the golden Ticket injected, you can access the shared files (C$), and execute services and WMI, so you could use psexec or wmiexec to obtain a shell (looks like yo can not get a shell via winrm).
switching back to the console the attacker used to create the golden ticket (local admin) and again attempting to access c$ share of the domain controller - this time is a success:
or Execute a cmd in the remote machine with PsExec:
reference:
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/kerberos-golden-tickets#execution https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket
Requirement:
krbtgt hash
Domain SID
Don't forget to use hostname instead of IP address of the remote server
"Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)"
it's mean there is mismatch datetime between kali linux and the remote machine, because authenticating using TGT is using time also.
Solve with this:
sudo ntpdate $IP
https://github.com/Zer1t0/ticket_converter
To convert tickets between Linux/Windows format with ticket_converter.py:
