Golden/Silver Ticket Attack
Last updated
Last updated
The ticket attack abuses the service account's password hash.
The Golden Ticket Attack abuses the krbtgt account's password hash to issue the Kerberos ticket-granting tickets as the KDC to access the resources.
After the adversary gets the account krbtgt's password hash, it can
create a valid Kerberos TGT for any user in the domain and
manipulate that user’s to gain additional privileges.
Attackers can mint service-granting tickets without communicating to the KDC, if they get the password hash for the service account.
With a service account's password hash, we can mint a service-granting ticket without interacting with the DC.
We can use the saved ccache file to authenticate to the service later.
