Silver Tickets
In the previous section, we obtained and cracked a TGS-REP hash
to retrieve the plaintext password of an SPN.
In this section, we’ll go one step further and forge our own service tickets.
In this section’s example,
we’ll create a silver ticket to get access to an HTTP SPN resource.
As we identified in the previous section,
the iis_service user account is mapped to an HTTP SPN.
Therefore, the password hash of the user account
is used to create service tickets for it.
For the purposes of this example, let’s assume we’ve identified that the
iis_service user has an established session on CLIENT75.
In general, we need to collect the following three pieces of information
to create a silver ticket:
SPN password hash, Domain SID, and Target SPN.
We’ve connected to CLIENT75 via RDP as jeff with his credentials.
First, let’s confirm that our current user has no access to the resource
of the HTTP SPN mapped to iis_service.
To do so, we’ll use iwr and enter -UseDefaultCredentials
so that the credentials of the current user are used to send the web request.
The output shows that we cannot access the web page as jeff.
Let’s start collecting the information needed to forge a silver ticket.
Since we are a local Administrator on this machine where iis_service has an
established session, we can use Mimikatz to retrieve the SPN password hash,
which is the first piece of information we need to create a silver ticket.
Let’s access PowerShell as Administrator and launch Mimikatz.
As we already learned, we can use privilege::debug,
and sekurlsa::logonpasswords to extract cached AD credentials.
The output shows the password hashes of the iis_service user account.
The NTLM hash of the service account is the first piece of information we need
to create the silver ticket.
Now, let’s obtain the domain SID, the second piece of information we need.
We can enter whoami /user to get the SID of the current user.
Alternatively, we could also retrieve the SID of the SPN user account from the
output of Mimikatz, since the domain user accounts exist in the same domain.
As covered in the Windows Privilege Escalation Module,
the SID consists of several parts.
Since we’re only interested in the Domain SID, we’ll omit the RID of the user.
The highlighted section in the output shows the domain SID.
The last list item is the target SPN.
For this example, we’ll target the HTTP SPN resource on WEB04,
because we want to access the web page running on IIS.
Now that we have collected all three pieces of information,
we can build the command to create a silver ticket with Mimikatz.
We can create the forged service ticket with the kerberos::golden module.
This module provides the capabilities for creating golden and silver tickets alike.
We’ll explore the concept of golden tickets in the module Lateral Movement
in Active Directory.
We need to provide the domain SID,
domain name,
and the target where the SPN runs.
We also need to include the SPN protocol,
NTLM hash of the SPN, and the /ptt option,
which allows us to inject the forged ticket into the memory
of the machine we execute the command on.
Finally, we must enter an existing domain user for /user:.
This user will be set in the forged ticket.
For this example, we’ll use jeffadmin.
However, we could also use any other domain user
since we can set the permissions and groups ourselves.
As shown in the output, a new service ticket for the SPN HTTP/web04.corp.com
has been loaded into memory and Mimikatz set appropriate group membership
permissions in the forged ticket.
From the perspective of the IIS application,
the current user will be both the built-in local administrator ( Relative Id: 500 ),
and a member of several highly-privileged groups,
including the Domain Admins group ( Relative Id: 512 ).
This means we should have the ticket ready to use in memory.
We can confirm this with klist.
The output shows that we have the silver ticket for jeffadmin to access
http/web04.corp.com submitted to our current session.
This should allow us to access the web page on WEB04 as jeffadmin.
Let’s verify our access using the same command as before.
Great!
We successfully forged a service ticket and got access to the web page
as jeffadmin.
It’s worth noting that we performed this attack without access to the plaintext
password or password hash of this user.
Once we have access to the password hash of the SPN,
a machine account, or user, we can forge the related service tickets for any
users and permissions.
This is a great way of accessing SPNs in later phases of a penetration test,
as we need privileged access in most situations to retrieve the password hash
of the SPN.
In this section, we learned how to forge service tickets by using the password hash
of a target SPN.
While we used an SPN run by a user account in the example,
we could do the same for SPNs run in the context of a machine account.