Skip to main content
AD Academy
Back to topics
Advanced Attacks and Modern Defenses
Advanced15 minLast updated: Topic 2 of 4

Golden Ticket and Silver Ticket

Forging Kerberos tickets and their implications.

Not read

What you will learn here

  • What Golden and Silver Tickets are
  • Why they are so dangerous
  • How to detect and recover

Worth reading first:AS-REP Roasting

A is a forged created using the krbtgt account's Hash. A Silver Ticket is a forged service ticket () created using the Hash of the service account itself.

  • Golden — near-complete control over the domain, valid even if users' passwords were changed.
  • Silver — quieter: doesn't touch the DC at all, making it hard to detect.
  • Recovery: change the krbtgt password twice, spaced by a Replication cycle.
# Check krbtgt password age
Get-ADUser krbtgt -Properties PasswordLastSet

# Reset krbtgt (twice, with a wait between)
# It is recommended to use the official New-KrbtgtKeys.ps1 script
powershell
Architecture and Theory — Under the Hood

= Forged signed with the krbtgt account's hash. Whoever possesses this hash can issue tickets for any user, including non-existent ones. Silver Ticket = Forged for a single service, signed with the service account's password and does not go through the DC at all.

  • Golden — Full domain control, valid even after user password changes.
  • Silver — Quieter: no traffic with the DC, hard to detect.
  • Forged PAC = Forged groups within the ticket.
Practical Configuration (PowerShell / GUI)
# Reset krbtgt — twice, at least 10 hours apart (replication cycle)
Reset-ADServiceAccountPassword # or the official script New-KrbtgtKeys.ps1

# Check krbtgt password age
Get-ADUser krbtgt -Properties PasswordLastSet
powershell
Real-world Scenarios in the Organization
  • After any Compromise event: resetting krbtgt is a mandatory step, otherwise the attacker remains inside.
Troubleshooting and Diagnosis
  • Event 4769 for a service not preceded by 4768 () = Suspicion of Silver Ticket.
  • Ticket with unusual validity (10 years) — default for forging tools.
  • User using a ticket that does not exist in .
Glossary and Quick Command Line
  • krbtgt — the account that signs all TGTs.
  • PAC — Privilege Attribute Certificate.
  • Tombstone for a ticket: 10 hours default.

Check yourself

What is needed to create a Golden Ticket?

Was this page helpful?

PreviousNext