HomeNotesWrite-Up'sBookshelfArticles

Golden Ticket

Description

The Kerberos Golden Ticket is an attack in which threat agents can create/generate tickets for any user in the Domain, therefore effectively acting as a Domain Controller.

krbtgt account:

  • Special account created by default when a domain is made.

  • Disabled, cannot be deleted, renamed, or enabled.

  • Used by the Domain Controller's KDC service to sign Kerberos tickets.

krbtgt password hash:

  • Used to sign all Kerberos tickets (TGTs – Ticket Granting Tickets).

  • Most trusted object in the domain.

  • If an attacker gets this hash, they can:

    • Create fake TGTs.

    • Give any privileges to these tickets (even admin).

    • Domain trusts them because they’re signed with the correct key.

  • The golden ticket attack can move from child domain to parent domain in the sam forest

  • It enables lon get persistance in the network

  • The tickets are forever lasting so eve nif the attacker is eradicated, he can come back easy

Attack

We perform the attack with Mimikatz and the following arguments:

  • /domain: The domain's name.

  • /sid: The domain's SID value.

  • /rc4: The password's hash of krbtgt.

  • /user: The username for which Mimikatz will issue the ticket (Windows 2019 blocks tickets if they are for inexistent users.)

  • /id: Relative ID (last part of SID) for the user for whom Mimikatz will issue the ticket.

Additionally, advanced threat agents mostly will specify values for the /renewmax and /endin arguments, as otherwise, Mimikatz will generate the ticket(s) with a lifetime of 10 years, making it very easy to detect by EDRs:

  • /renewmax: The maximum number of days the ticket can be renewed.

  • /endin: End-of-life for the ticket.

1. We need to obtain the password hash for krbtgt and the SID value of the domain. We do this like shown in the DCSync attack. And look for the NTLM hash.

Get passwrod hash

2. Use the Get-DomainSID in PowerView to get the SID of the Domain

Get SID of the domain

3. Now, armed with all the required information, we can use Mimikatz to create a ticket for the account Administrator. The /ptt argument makes Mimikatz pass the ticket into the current session

Create the ticket

The output shows that Mimikatz injected the ticket in the current session, and we can verify that by running the command klist (after exiting from Mimikatz):

Verify loaded tickets

To verify that the ticket is working, we can list the content of the C$ share of DC1 using it

List contents of C share of DC1

Prevention

  • ❌ Block privileged users from authenticating to any device.

  • 🔁 Periodically reset krbtgt password:

    • Use Microsoft's KrbtgtKeys.ps1 script:

      • Has audit mode (checks for issues before reset).

      • Forces DC replication to avoid sync issues.

  • 🧹 Enable SIDHistory filtering between domains:

    • Prevents privilege escalation from child → parent domains.

    • ⚠️ May cause issues during domain migrations.

Detection

  • Watch for unusual login behavior (time, location, device).

  • Use Privileged Access Workstations (PAWs) for admins.

  • Alert if privileged users log in from non-PAW machines.

  • Monitor event IDs 4624 (success) and 4625 (fail).

Note

If an Active Directory forest has been compromised, we need to reset all users' passwords and revoke all certificates, and for krbtgt, we must reset its password twice (in every domain). The password history value for the krbtgt account is 2. Therefore it stores the two most recent passwords. By resetting the password twice, we effectively clear any old passwords from the history, so there is no way another DC will replicate this DC by using an old password. However, it is recommended that this password reset occur at least 10 hours apart from each other (maximum user ticket lifetime); otherwise, expect some services to break if done in a shorter period.

Useful video

Tasks

Task 1

Practice the techniques shown in this section. What is the NTLM hash of the krbtgt user?

Log in as Rocky, the user has more privileges, like we did in the DCSync excersise. Launch Mimikatz and perform the dcsync for the defualt user krbtgt.

Copy the password hash, that is also the answer to our question. But lest dig a bit more.

db0d0630064747072a7da3f7c3b4069e

Back on our bob user, get the domain SID

S-1-5-21-1518138621-4282902758-752445584

Perform the golden ticket creation command.

You can verify if the ticket is loaded in the sesion

And list the share in the DC1 from the rocky user

PreviousDCSyncNextKerberos Constrained Delegation

Last updated