# Exploiting domain trusts (Kerberos Golden Ticket)

### Resources

1. **DCSync attack**

{% embed url="https://www.extrahop.com/resources/attacks/dcsync" %}

{% embed url="https://tools.thehacker.recipes/mimikatz/modules/lsadump/dcsync" %}

2. **Kerberos notes**

{% embed url="https://jarrettgxz-sec.gitbook.io/windows/active-directory-ad/authentication-methods/kerberos" %}

### Terminologies

1. _Kerberos Ticket Granting Ticket (_**KRBTGT**)

* The service account for the Key Distribution Center (KDC) service
* This account is used to encrypt and sign all Kerberos tickets for the domain

2. Golden ticket

* A TGT is signed with the **KRBTGT** account's password hash
* Thus, with access to this hash, we will be able to forge a TGT for any user of our choice
* This ticket is known as a "_**Golden Ticket**_"

### Overview

In this attack, we abuse the trusts between domains in a forest.

...



#### General overview of the Golden Ticket attack

Refer to the "_**Terminologies**_" section above for more details on the Golden Ticket.

In a Golden Ticket attack, an attacker who has obtained the **KRBTGT** account hash for a domain can forge their own Ticket Granting Ticket (TGT) for any user of their choice. This forged TGT, known as a Golden Ticket, is signed with the **KRBTGT** hash, making it appear valid to the domain’s Key Distribution Center (KDC).&#x20;

This particular TGT can be used to request service tickets (TGS) for any service as the specified user, effectively gaining unrestricted access within the domain (eg. _Administrator_).

...



