Golden Ticket kendiliğinden oluşturulan bir Kerberos Ticket çeşididir. En yaygın olanı, Domain Yöneticisi yetkilerine sahip bir Golden Ticket oluşturmaktır.
The Golden Ticket attack enables attackers to forge and sign TGTs (Ticket Granting Tickets) using the krbtgt account's password hash. When these tickets get presented to an AD server, the information within them will not be checked at all and will be considered valid due to being signed with krbtgt account's password hash. For example, it is possible to sign a ticket for a user that does not exist, such as DoesNotExist, have the ticket also say they are a Domain Administrator, and request a TGS (Ticket Granting Service) ticket which enables them to access remote machines. For stealth reasons, it is almost always better to utilize users that exist in the domain. However, putting fake information in the ticket can be a great way to show the impact and the lack of monitoring an organization has around these events.
One of the scariest things about the Golden Ticket attack is how often pentesters will gain access to this key; when performing DCSYNC (using Mimikatz) or SecretsDump (using Impacket), the key is KRBTGT's NTLM hash. This account is special because changing its password has to be done twice and cannot be done in rapid succession. The AD Forest must reach full convergence, meaning the change has to replicate across the entire domain before it can be changed again. This is because this key is used for Domain Controllers to authenticate with each other! It should happen within 10 hours, but organizations typically wait 24 hours to minimize the chance of any issue. Within that time Window, if the attacker notices it changed and they grab it again, the process will have to be repeated.
GUI’dan yapmak istersek Beacon Menu’den -> Access -> Golden Ticket seçerek oluşturabiliriz.
User için SID değerini :
- run whoami /user ile öğrenebiliriz.
Komut satırından çalıştığımız user’a inject etmek için :
- kerberos_ticket_use [/path/to/ticket]
- kerberos_ticket_purge
Sessionumuzla ilişkili bütün kerberos ticketlarını silmek için kullanılır.