Golden & Silver Tickets
A Kerberos ticket is just data plus a signature, and a DC trusts the signature blindly, normally because a real logon produced it. Golden/Silver tickets skip the logon entirely: if the signing secret is already known, a ticket can be handwritten claiming to be anyone, and it still checks out, since it was signed with the real key. The difference is whose secret gets used, which decides how far the forged ticket reaches:Silver Ticket
- Use when: access to one specific service is the goal, a file share, a SQL instance, a single website, not the whole domain.
- Why: quieter than Golden, it never touches
krbtgtor the DC at all for some services, since the target service validates it locally with its own key. - Prerequisites: that one service account’s NTLM hash, the domain SID, and the target service’s hostname/SPN.
Golden Ticket
- Use when: the goal is full domain persistence, not one service, this is the “never lose access again” move after a domain compromise.
- Why: trusted everywhere, by every DC, for any service, and survives individual password resets since it’s signed with
krbtgt, not the target account’s own hash. - Prerequisites: the
krbtgtaccount’s NTLM hash (from DCSync or anNTDS.ditdump) and the domain SID.
The Mimikatz Commands, Flag by Flag
Silver Ticket:| Flag | Meaning |
|---|---|
/domain | The domain FQDN the ticket is being forged for. |
/sid | The domain’s SID (just the domain portion, not a full user SID, this is the piece every account’s SID shares). |
/target | The FQDN of the host running the target service, the ticket is scoped to this one machine. |
/service | The SPN’s service class, e.g. cifs for file shares, http for a web service, mssql for SQL Server, whatever the target service actually registered. |
/rc4 | The service account’s NTLM hash |
/user | The username to claim inside the forged ticket |
/ptt | Inject the forged ticket directly into the current logon session (Pass-the-Ticket) instead of saving it to a file. |
| Flag | Meaning |
|---|---|
/user | The username to claim, again doesn’t need to be real. |
/domain / /sid | Same as above, the domain FQDN and domain SID. |
/krbtgt | The krbtgt account’s NTLM hash, the domain wide TGT-signing key, this is what makes it a Golden ticket rather than a Silver one. |
/id | The RID to forge into the ticket as the user’s own, 500 is the known RID for the built in Administrator account. |
/groups | Comma separated RIDs of the groups the forged ticket should claim membership in, 512 is Domain Admins, the group that actually grants the access, /id alone doesn’t. |
/startoffset | Minutes before now the ticket’s validity starts, 0 means valid immediately. |
/endin | How many minutes the ticket stays valid, 600 (10 hours) matches the domain’s default maximum ticket lifetime, so it doesn’t stand out as unusually long lived. |
/renewmax | How many minutes the ticket can be renewed for before it must be reissued, 10080 (7 days) matches the typical domain default. |
/ptt | Same as above, inject directly rather than save to disk. |
Quick Reference Tools
Kerberoasting
Request a crackable TGS for any SPN-carrying account, needs a valid credential.
AS-REP Roasting
Request a crackable AS-REP for accounts with pre-auth disabled, needs no credential at all.
Windows Credentials Attacks
Local-host credential extraction, the hashes used to forge tickets above usually come from there.
Pass-the-Ticket
What to actually do with a ticket forged here, on another host.