Welcome to the last attack for the Active Directory section.
This makes me happy and sad because we're going to have to leave it here.
So golden ticket is going to be a the attack.
We're actually going to use a golden ticket attack and surprise a pass the ticket attack as well.
We'll talk about both of those.
So what is a golden ticket and why do we care.
Well in the last video you saw me dump the K B TGT account right.
What is that.
That's the curb gross ticketing count the ticket granting ticket account that allows us to generate
tickets.
Well what if we have the hash of that account then guess who gets to generate curb gross ticket writing
tickets.
We do so with a cobra's take a grading ticket.
We can request access to any resource or system on the domain using the ticket granting service.
OK.
So what does that mean in layman's terms that means when we have a golden ticket we have complete access
to the entire domain.
All the machines we can gain shells on them.
We can get all the files all the folders etc..
So this is such a cool attack here.
So we're going to go ahead and try to pull this off.
Let's go ahead and do Mimi Katz dot EMC and I'm going to show you the technique that I use when I do
this.
So go ahead and do your privilege debug as always and from here instead of doing the LSA dump LSA patch
we're just going to say inject like this and we're going to pull down the actual user we want.
That way we don't pull down all the users we're just gonna pull down one user so I'm pulling down by
name and the care B TGT account.
Go ahead and hit enter and when you do this.
Go ahead open up a notepad as well so open up a notepad and we're gonna go ahead and scroll up.
We need a few things.
We need the SCADA of the domain.
So go ahead and copy that and paste that in here and you need the end tell them hash of the curve rows
take a granting ticket account so go ahead and copy that paste that in here as well.
The rest you should be good to go.
We're going to be able to generate our ticket based off of this.
So we're going to do is we're gonna do something along the lines of this.
So we're going to say curb arrows if it'll type curve arrows and gold in like that.
The user here is I always like to put administrator.
You don't have to.
You could put fake user fake user 1 to 3 whatever you want.
Here it doesn't matter.
I can type but it doesn't have to be a real user.
The domain does have to be real so domain here is Marvel dot local.
And then we need the SCADA of the domain.
So let's go ahead and grab that
and paste it here.
We also need the curb gross ticket granting ticket account so care be TGT.
Go ahead and grab that hash that we copied or right click there.
Paste that and then we're going to supply the I.D..
So I.D. of five hundred here.
It didn't work.
Sorry.
The copy paste messed up.
We'll do I.D. of five hundred and that just stands for your AR I.D. So if you're familiar the I.D. is
the admin account of five hundred.
So we're going to use I.D. of five hundred and the last thing we're gonna do is we're going to say P
T T.
Just like that.
So what does that stand for.
That stands for.
Pass the ticket.
So we're going to generate a golden ticket here and then we're going to use past the ticket we're going
to pass that ticket along to our next session.
Right.
Or the current session and we're going to utilize that ticket to open up a command prompt and that command
prompt is going to be able to access any computer we want.
OK.
So let's go ahead and do this.
We're going to pass the ticket generate this.
Go ahead hit enter and you see it says pass the ticket.
OK.
And it says golden ticket for administrator of marvel that local successfully submitted for current
session.
Current session.
So let's go ahead and do something like this.
Miscellaneous and then command
OK.
Now we've got this command prompt up and we're utilizing the session and the golden ticket we just created.
Now let's try to say something like Dir.
And we can utilize something like we could try the punisher.
Let's see if it takes with the name resolution here see dollar sign and look at that.
We just did a directory of the Punisher from our machine.
We could take this further.
OK.
If we have P.S. exact downloaded to this machine.
P.S. exactly.
Remember this is a tool used for windows like this.
Right.
We can access computers with P.S. exact.
That was the whole intent of P.S. exact being created so we can download the windows tool of P.S. exact
and gain access to this machine if we want to.
So that's going to be my challenge to you if you want to have some more fun with this.
Take this a step further and go out go download P.S. Exactly.
So again all you're going to look for is P.S. exact EMC and that is a Windows tool so you should be
able to find on the windows site download it and then run P.S. exact dot EMC and run it against this
computer run it in something like this against the Punisher and then run against commands.
EMC just like that.
And guess what.
You're gonna get a shell on this machine.
This is an awesome attack.
You have complete control on top of this.
You can think of a golden ticket as persistence.
Once you own the domain controller yes you can go add in a user name and you can create your own account.
Make them a domain admin.
A lot of places will pick up on that.
Not everybody is picking up on the golden ticket quite yet.
And if you want to get stealth there look into what a silver ticket is.
That's starting to be the way to go.
Now that golden tickets are starting to get picked up a little bit.
So what we're gonna do is end this here.
That's my challenge to you.
Go out download.
Yes exactly.
Play around with it.
Make this your own go out there and look at more Mimi Katz commands.
Learn all the different little tools and techniques you have the lab built for it.
Everything is ready to roll.
So I'm going to cover in the next video some good resources for you to study.
We'll talk about a little bit about certifications and what's out there.
And then we're gonna go ahead and move on and get out of active directory pen testing.
It has been a fun ride so I'll catch you over in the next video.