Silver Tickets

A "silver ticket" is a forged TGS, signed using the secret material (RC4/AES keys) of a computer account. You may forge a TGS for any user to any service on that machine, which is useful for short/medium-term persistence. By default, computer passwords change every 30 days, at which time you must re-obtain the new secrets to continue making silver tickets. Both silver and golden (coming up next) tickets are forged, so can be generated on your own machine and imported into your Beacon session for use.

Let's say we dumped Kerberos keys from Workstation 1 from a SYSTEM Beacon.

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : WKSTN-1$
Domain            : DEV
Logon Server      : (null)
Logon Time        : 9/9/2022 9:37:22 AM
SID               : S-1-5-20

	 * Username : wkstn-1$
	 * Domain   : DEV.CYBERBOTIC.IO
	 * Password : (null)
	 * Key List :
	   aes256_hmac       c9e598cd2a9b08fe31936f2c1846a8365d85147f75b8000cbc90e3c9de50fcc7
	   rc4_hmac_nt       fc0c8a61a83bafdffc587956d0020398
	   rc4_hmac_old      fc0c8a61a83bafdffc587956d0020398
	   rc4_md4           fc0c8a61a83bafdffc587956d0020398
	   rc4_hmac_nt_exp   fc0c8a61a83bafdffc587956d0020398
	   rc4_hmac_old_exp  fc0c8a61a83bafdffc587956d0020398

\

On your Windows attacking machine, use Rubeus to forge a TGS for nlamb and the cifs service.

\

Then import the ticket.

\

Here are some useful ticket combinations:

Technique

Required Service Tickets

psexec

CIFS

winrm

HOST & HTTP

dcsync (DCs only)

LDAP

PreviousDomain DominanceNextGolden Tickets

Last updated