Golden Ticket
To test this persistence technique,
we will first attempt to laterally move from the Windows 11 CLIENT74 workstation
to the domain controller via PsExec as the jen user
by spawning a traditional command shell with the cmd command.
This should fail because we do not have the proper permissions.
At this stage of the engagement, the golden ticket will require us
to have access to a Domain Admin’s group account or to have compromised
the domain controller itself in order to work as a persistence method.
With this kind of access,
we can extract the password hash of the krbtgt account with Mimikatz.
To simulate this, we’ve logged in to the domain controller via remote desktop
using the jeffadmin account, we can run Mimikatz from C:\Tools,
and issue the lsadump::lsa command[^lsa].
Having obtained the NTLM hash of the krbtgt account,
along with the domain SID, we can now forge and inject our golden ticket.
Creating the golden ticket and injecting it into memory
does not require any administrative privileges
and can even be performed from a computer that is not joined to the domain.
We’ll take the hash and continue the procedure from a compromised workstation.
Back on CLIENT74 as the jen user, before generating the golden ticket,
we’ll launch mimikatz and delete any existing Kerberos tickets
with kerberos::purge.
We’ll supply the domain SID, which we can gather with whoami /user,
to the Mimikatz kerberos::golden command to create the golden ticket.
This time, we’ll use the /krbtgt option instead of /rc4
to indicate we are supplying the password hash of the krbtgt user account.
Starting July 2022, we’ll need to provide an existing account,
so let’s set the golden ticket’s username to jen.
Mimikatz provides two sets of default values
when using the golden ticket option:
the user ID and the groups ID.
The user ID is set to 500 by default,
which is the RID of the built-in administrator for the domain,
while the values for the groups ID
consist of the most privileged groups in Active Directory,
including the Domain Admins group.
With the golden ticket injected into memory,
we’ve launched a new command prompt with misc::cmd
from which we again attempt lateral movement with PsExec.
We have an interactive command prompt on the domain controller
and notice that the whoami command reports us to be the user jen,
which is now part of the Domain Admin group.
Listing group memberships shows that we are now a member
of multiple powerful groups including the Domain Admins group.
Excellent.
Note that by creating our own TGT and then using PsExec,
we are performing the overpass the hash attack
by leveraging Kerberos authentication as we discussed earlier in this Module.
If we were to connect PsExec to the IP address
of the domain controller instead of the hostname,
we would instead force the use of NTLM authentication
and access would still be blocked.
In this section, we have demonstrated the golden ticket technique
as a persistence mechanism.
By obtaining the NTLM hash of the krbtgt user,
we can issue domain-administrative TGTs to any existing low-privileged account
and thus, obtain inconspicuous legitimate access to the entire AD domain.