Golden/Silver Ticket Attack
Overview
The ticket attack abuses the service account's password hash.
Golden Ticket Attack
The Golden Ticket Attack abuses the krbtgt account's password hash to issue the Kerberos ticket-granting tickets as the KDC to access the resources.
After the adversary gets the account krbtgt's password hash, it can
create a valid Kerberos TGT for any user in the domain and
manipulate that user’s PAC to gain additional privileges.
Tools
Labs
Silver Ticket Attack
Attackers can mint service-granting tickets without communicating to the KDC, if they get the password hash for the service account.
Tools
With a service account's password hash, we can mint a service-granting ticket without interacting with the DC.
We can use the saved ccache file to authenticate to the service later.
Labs
Last updated