AdvancedActive Directory

Silver Ticket Attacks: Service Ticket Manipulation

Complete technical guide to silver ticket attacks including forged service tickets, comparison with golden tickets, creation techniques, and defensive strategies for Active Directory.

#Silver Ticket#Kerberos#Service Ticket#Active Directory#Persistence

The Silent Service Compromise

A silver ticket is a forged Kerberos service ticket (TGS) that grants access to a specific service without interacting with the domain's KDC. Unlike golden tickets which forge TGTs using the KRBTGT hash, silver tickets forge service tickets using only the target service account's NTLM hash. Silver tickets are more limited in scope but significantly more stealthy — they exploit the service ticket architecture without generating KDC events.

Silver Ticket vs Golden Ticket

Golden Ticket: Forges TGT, requires KRBTGT hash, grants full domain access, generates KDC events.

Silver Ticket: Forges TGS, requires service account hash, grants single-service access, generates no KDC events.

Common Service Targets

**CIFS** — File share access

**HTTP** — Web service access

**LDAP** — Domain controller queries

**HOST** — Remote management

**MSSQLSvc** — SQL Server access

Creating Silver Tickets

# CIFS silver ticket for file share access
mimikatz.exe "kerberos::golden /domain:corp.local /sid:S-1-5-21-XXXXXXXXXX /target:FileServer.corp.local /service:CIFS /rc4:SERVICE_NTLM_HASH /user:Administrator /id:500 /ptt" "exit"

# HOST silver ticket for remote management
mimikatz.exe "kerberos::golden /domain:corp.local /sid:S-1-5-21-XXXXXXXXXX /target:Server01.corp.local /service:HOST /rc4:SERVICE_NTLM_HASH /user:Administrator /ptt" "exit"

# LDAP silver ticket for AD enumeration
mimikatz.exe "kerberos::golden /domain:corp.local /sid:S-1-5-21-XXXXXXXXXX /target:DC01.corp.local /service:LDAP /rc4:DC_COMPUTER_HASH /user:Administrator /ptt" "exit"

Note: Mimikatz uses kerberos::golden for both — the difference is the inclusion of /target and /service parameters.

Using Silver Tickets

# After injecting CIFS silver ticket
dir \\FileServer\c$

# After injecting HOST and CIFS tickets
psexec \\TargetServer cmd.exe

# After injecting LDAP ticket
powershell.exe -c "Get-ADUser -Filter *"

Detection Challenges

Silver tickets generate no KDC traffic since the forged TGS is presented directly to the service. Detection requires service-side event logs:

**Event ID 4624** — Network logon with anomalous properties

**Event ID 4672** — Special privileges during non-interactive logon

User behavior analytics — accessing services not in normal pattern

Common Mistakes

Creating tickets with too much privilege (unusual access patterns)

Failing to match encryption types (AES-only services reject RC4 tickets)

Overlooking service account hash rotation

Best Practices

Use **managed service accounts (gMSA)** with automatic rotation

Deploy **AES-only Kerberos encryption**

Rotate **computer account passwords** regularly

Monitor **service account password changes**

Audit **service access logs** for anomalous patterns

Related Tools

**Mimikatz** — Silver ticket creation

**Rubeus** — Modern ticket manipulation

**Impacket** — ticketer.py for Python

Golden Ticket Attacks: Kerberos Ticket Forging Explained

Kerberos Explained: Authentication Protocol Deep Dive

Active Directory Fundamentals: Windows Network Domains

Pass-the-Hash: Understanding NTLM Authentication Attacks

Summary

Silver tickets are forged service tickets providing access to specific services without KDC interaction. While more limited than golden tickets, they offer superior stealth. Defending requires protecting service account hashes, AES-only encryption, managed service accounts, and monitoring service-side access logs.

Related SMB Tool Recommendations

[SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares

[Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies

[Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output

[NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing

[CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks

[NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

Knowledge Check

What hash is required to forge a silver ticket?

Why are silver tickets harder to detect than golden tickets?

What services can be targeted with silver tickets?

How does rotating a service account password affect existing silver tickets?

Frequently Asked Questions

What is a silver ticket attack?

A silver ticket forges a Kerberos service ticket (TGS) to access a specific service without contacting the domain KDC. It uses the target service account's NTLM hash, making it more stealthy than golden tickets but limited to a single service.

What hash is required to forge a silver ticket?

The NTLM hash of the target service account is required. For example, to access a file server's CIFS service, you need the computer account's NTLM hash. Each service type (CIFS, HTTP, LDAP, MSSQLSvc) requires the specific service account hash.

Why are silver tickets harder to detect than golden tickets?

Silver tickets generate no KDC traffic since the forged TGS is presented directly to the target service. Golden tickets generate Event ID 4768 when requesting a TGT from the KDC. Without KDC interaction, silver tickets avoid the most common Kerberos detection points.

What services can be targeted with silver tickets?

Common targets include CIFS (file shares), HTTP (web services), LDAP (domain controller queries), HOST (remote management), and MSSQLSvc (SQL Server). Each requires the corresponding service account's NTLM hash and SPN configuration.

How does rotating a service account password affect silver tickets?

Rotating the service account password changes its NTLM hash, immediately invalidating any existing silver tickets encrypted with the old hash. This is why using managed service accounts (gMSA) with automatic rotation is an effective defense.

What is the difference between a silver ticket and pass-the-hash?

Pass-the-hash uses an NTLM hash for NTLM authentication (challenge-response). Silver tickets use a service account hash to forge Kerberos service tickets. PtH requires NTLM to be enabled; silver tickets work even when NTLM is disabled.

What is a managed service account (gMSA) and how does it prevent silver tickets?

gMSAs automatically rotate their passwords (and NTLM hashes) every 30 days. Since silver tickets require the current service account hash, automatic rotation limits the window of exposure and makes stolen hashes expire quickly.

How does AES-only Kerberos encryption affect silver tickets?

If a service is configured to accept only AES encryption, silver tickets forged with RC4 (NTLM) hashes will be rejected. Enforcing AES-only across all services prevents silver ticket attacks that rely on older RC4 encryption.

What Event IDs indicate potential silver ticket activity?

Monitor Event ID 4624 (network logon with anomalous properties) and 4672 (special privileges during non-interactive logon) on the target service. Look for access patterns that deviate from the user's normal behavior.

Can silver tickets provide domain admin access?

Silver tickets provide access only to the targeted service on the targeted host. They do not grant domain-wide access like golden tickets. However, an attacker can create multiple silver tickets for different services to expand their access gradually.

What is a CIFS silver ticket used for?

A CIFS silver ticket provides access to SMB file shares on a specific server. It forges a service ticket for the CIFS service using the computer account's hash, allowing the attacker to access file shares without valid domain credentials.

How do organizations defend against silver ticket attacks?

Deploy managed service accounts with automatic rotation, enforce AES-only Kerberos encryption, monitor service access logs for anomalies, audit SPN configurations, and implement network segmentation to limit lateral movement from compromised services.