A Golden Ticket is a forged Kerberos ticket that allows an attacker to gain unauthorized access to resources in a Windows domain. It is one of the most powerful tools in the arsenal of attackers using Mimikatz for post-exploitation activities.
What is a Golden Ticket 🎟️?
- Kerberos Ticket Granting Ticket (TGT): In a Kerberos authentication environment, a TGT is issued by the Key Distribution Center (KDC) when a user logs in. This ticket allows the user to request service tickets for accessing various resources in the domain.
- Golden Ticket: A Golden Ticket is a forged TGT that can be created using the NTLM hash of the
krbtgt account (the account used by the KDC to encrypt TGTs). By creating a Golden Ticket, an attacker can impersonate any user in the domain, including administrative accounts, without needing the actual password.
⚠️ What Can You Do with a Golden Ticket?
- Access Any Resource: With a Golden Ticket, you can access any resource in the domain, including file shares, databases, and other services, as if you were the user you are impersonating.
- Persistence: An attacker can use a Golden Ticket to maintain access to a compromised network even after the initial breach is detected and remediated.
- Privilege Escalation: By impersonating high-privilege accounts (like domain admins), an attacker can escalate their privileges and gain control over the entire domain.
- Lateral Movement: A Golden Ticket can be used to move laterally across the network, accessing other machines and resources without raising alarms.
الي معاه التيكيت دي كأنه صاحب الشركه مثلا ويقدر يروح في اي مكان ويدخل اي اوضه ومحدش يقدر يقوله انت بتعمل ايه لان عمرك مثلا هتشك في صاحب الشركه
Value of a Golden Ticket
The value of a Golden Ticket lies in its ability to grant extensive access and control over a Windows domain. It effectively allows an attacker to bypass normal authentication processes and impersonate any user, making it a powerful tool for both attackers and penetration testers.
How to Create a Golden Ticket with Mimikatz
To create a Golden Ticket using Mimikatz, you need:
- NTLM Hash of the krbtgt Account: This is the hash of the
krbtgt account, which is used to encrypt TGTs.
- Domain SID: The Security Identifier (SID) of the domain.
- Domain Name: The name of the domain where the ticket will be valid.