In this demonstration, we're going to use Mimikatz to create a silver ticket,
which is a forged Kerberos service authentication ticket.
The use of this ticket is not validated by the domain controller and is only
valid for the service and system that you created it for.
Unlike many of the other attacks we have demonstrated so far,
this attack does not require any special privileges.
There are various attack scenarios in which you
might want to use silver tickets.
For instance,
if you had already performed Kerberoasting and pulled down
and cracked the password for the service,
then you could use this to create a forged ticket.
In this case and demonstration,
we are going to leverage information obtained during a previous
demonstration to create a silver ticket using the DC01 system hash.
That ticket will then be used to access the file share on the
domain controller. The username and the user ID can absolutely
be something that you just make up.
This can then make it more difficult for someone that is trying to track
you. In this demonstration we're going to create a silver ticket so that we
can access the domain controller file share.
So log in as Olaf Jackson,
who is a local system administrator only. I'm going to run the command prompt,
not as an administrator, but my user, and I'm going to go ahead and copy the
domain SID here. Then let's try some out here.
Pushd, we'll try to access this file share here, and as expected,
access is denied.
So let's go to Mimikatz and run Mimikatz directly from here,
and I'll go ahead and expand the screen here,
check our privileges, and we did get an error message,
which was expected.
So let's try this.
Kerberos::golden, so just like with the golden ticket that starts out
at the same when you want to make a silver ticket,
we need the sid, which I just copied, so I'll paste that here, and I'll need
an rc4. Let's take a look at where I can get that from.
So if I look at Mimikatz, I've got one here with DomainHash, and
this time I'm looking for this machine hash right here for DC01. So
I'm going to copy that back into my window here, and that will be
under rc4. We need a user, so we use tigerkingz, and this username
can be anything.
And we need an ID,
which is also something I can just make up. We need a target,
DC01.GLOBOMANTICS.LAB1. We need a service, which in this case is cifs because
there are silver tickets that you can make for lots of different services,
and we'll tell it to go ahead and pass the ticket.
Let's check.
We've got kerberos::golden sid, the rc4, the user tigerkingz, the
ID, the target, and we're missing our domain.
Here we go.
Let's give this a try. There we have our tigerkingz@globomantics.lab,
and this is for the DC01 system, and it is for cifs.
So let's give it a try.
And we used pushd to open that up, and this time it actually let us in.
Take a look at that directory, and that is the DC01, DC01 Globomantics system,
which is exactly what we wanted.
So at this point,
we could upload malware or do pretty much anything we needed
to that you can do with a file system.
So let's go ahead and popd, and that'll exit that out,
and finish up with clearing the screen.