Silver Ticket Forgery
Theory
In this attack we forge a TGS and use it to get unrestricted access to a SPN.
The reason we can do this is because the user SID in the TGS isn't verifed by the SPN when decrypting the TGS (since only the DC and the SPN are supposed to be able to decrypt the TGS).
This means only the permissions will be checked in the TGS.
Theory Recap
We create a TGS with full permissions and encrypt it using the SPN hash
We send it to the SPN and gain full access to the service
Attack
Prepare
We need to collect the following to forge the ticket:
The SPN password hash (let's assume we already have it)
The domain SID
The target SPN (let's assume it's
HTTP/web04.corp.com)
To get the domain SID we get our SID and remove the RID at the end:
Domain SID is S-1-5-21-1987370270-658905905-1781884369
Forge TGS
When we attempt to access the SPN (the webserver) we cannot:
We will forge a TGS using mimkatz:
Hash goes in /rc4:
Now we have a full permission TGS for the SPN. We can verify:
When we try to access the webserver again:
Last updated