📖 What is Silver Ticket?
A Silver Ticket is a forged Kerberos Ticket Granting Service (TGS) ticket that grants an attacker access to a specific service on a specific server. It is created using the service account's password hash rather than the KRBTGT account hash.
"Unlike Golden Tickets, which grant domain-wide access, Silver Tickets are service-specific. They are stealthier because they do not require communication with the Domain Controller."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Silver Ticket?
- ▸ Requires the NTLM hash of the specific service account or computer account to forge a valid Ticket Granting Service (TGS) ticket.
- ▸ Bypasses the Domain Controller entirely during the authentication process, as the forged ticket is presented directly to the target service.
- ▸ Provides access only to the specific service, such as CIFS, MSSQL, or HTTP, for which the ticket was forged, limiting the attack scope.
- ▸ Allows attackers to manipulate the Privilege Attribute Certificate (PAC) to grant themselves administrative rights on the targeted server or service.
🎯 How does Silver Ticket appear on the PT0-002 Exam?
You may be asked to identify an attack where a penetration tester uses a compromised service account hash to access a file share without contacting the Domain Controller.
A scenario might describe an attacker who lacks the KRBTGT hash but possesses a computer account hash and wants to gain administrative access to a specific server.
❓ Frequently Asked Questions
How does a Silver Ticket differ from a Golden Ticket in terms of requirements?
A Golden Ticket requires the KRBTGT account hash for domain-wide access, whereas a Silver Ticket only requires the hash of a specific service account for targeted access.
Why is it harder for defenders to detect Silver Tickets than Golden Tickets?
Because Silver Tickets are presented directly to the target server, no request is sent to the Domain Controller, leaving no authentication logs on the DC.