📖 What is Golden Ticket?
A Golden Ticket is a forged Kerberos Ticket Granting Ticket (TGT) created after an attacker compromises the KRBTGT account in an Active Directory environment. This allows the attacker to impersonate any user and gain unrestricted access to any service in the domain.
"This represents the ultimate level of persistence in an AD environment; the only way to invalidate a Golden Ticket is to change the KRBTGT account password twice."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Golden Ticket?
- ▸ The KRBTGT account's NTLM hash is the critical secret required to sign and encrypt forged Ticket Granting Tickets (TGTs) in an Active Directory domain.
- ▸ Forged TGTs allow attackers to request Service Tickets for any resource, bypassing the standard authentication process and the need for user passwords.
- ▸ Attackers manipulate the Privilege Attribute Certificate (PAC) within the ticket to grant themselves high-level permissions, such as Domain Admin rights, regardless of actual group membership.
- ▸ Golden Tickets provide extreme persistence because they remain valid even after a user changes their password, as the ticket is signed by the KRBTGT key.
- ▸ Complete remediation requires resetting the KRBTGT account password twice to clear the password history and invalidate all previously issued forged tickets.
🎯 How does Golden Ticket appear on the PT0-002 Exam?
You may be asked to identify the attack type when a scenario describes an adversary using a compromised KRBTGT hash to maintain permanent, unrestricted access to an Active Directory domain.
A scenario might describe a situation where an attacker has gained Domain Admin privileges and is using Mimikatz to forge a TGT; you must identify this as a Golden Ticket attack.
Expect questions regarding the remediation steps for a domain-wide compromise, specifically focusing on the necessity of rotating the KRBTGT account password twice to ensure all forged tickets are revoked.
❓ Frequently Asked Questions
What is the primary difference between a Golden Ticket and a Silver Ticket?
A Golden Ticket is a forged TGT that grants access to any service in the domain via the KRBTGT account. A Silver Ticket is a forged TGS that grants access only to a specific service using that service's own account hash.
Can a Golden Ticket be detected by standard security logs?
They are difficult to detect because they appear as legitimate tickets. However, security analysts look for anomalies like unusually long ticket lifetimes or TGTs that do not have a corresponding authentication event in the logs.