Domain dominance and persistence
In this section, you will learn how to perform advanced techniques to abuse the trust within Kerberos and an Active Directory domain to gain dominance over all devices within a Windows domain and set up persistence within Active Directory.
You will learn about the fundamentals of creating the following tokens on Active Directory:
- Golden ticket
- Silver ticket
- Skeleton key
Let’s take a deeper dive into abusing the trust within Active Directory.
Golden ticket
A golden ticket is a special token that is created by penetration testers using the Security Identifier (SID) of the domain, the domain name, and the NTLMv1 hash of the Kerberos TGT. The golden ticket allows a penetration tester to gain access to any device within the domain by performing PTT.
This is possible because the golden ticket is encrypted using the hash of the Kerberos TGT account, which is the built-in krbtgt
account on Active Directory...