Similar but more powerful than silver ticket forgery. This time we will forge a TGT by using the krbtgt password hash. We can create a TGT for any user with any groups! Even if not actually real in AD database, the TGT will trump that, as long as its valid the KDC will accept it.
First, on the DC, we must dump the hash of krbtgt. With mimikatz but it slightly differs:
> privilege::debug
> lsadump::lsa /patch
lsadump::lsa /patch Targets the LSA Secrets and cached credentials.
Now from any domain joined machine (or not) we can launch mimikatz, create a TGT and inject it in our session. We need the SID (check how we did for silver tickets).