Golden Ticket

A Golden Ticket is what an attacker builds once they hold the krbtgt account’s password hash — usually pulled via DCSync. With that hash they can forge their own Ticket Granting Tickets for any user, including a fabricated Domain Admin who doesn’t even need to exist, and the forged ticket stays valid until krbtgt is rotated. It isn’t an entry point but a persistence and impersonation technique: it presumes the Active Directory domain is already compromised. The forged ticket gets used the same way any Pass-the-Ticket is — injected and replayed over Kerberos on port 88.

How It Works

• Obtain the krbtgt hash. Almost always via DCSync, though any DC compromise that dumps the NTDS.dit works too.
• Forge the TGT. mimikatz’s kerberos::golden or Rubeus builds a ticket offline using the hash, no KDC involved.
• Pick the SIDs. The forger sets arbitrary group memberships — SID 512 (Domain Admins) is the usual choice, since Kerberos trusts whatever the ticket claims.
• Set a long lifetime. Golden Tickets are commonly forged to last years, far outliving normal TGT limits.
• Inject and use. The forged ticket is loaded into a session and replayed as a Pass-the-Ticket to authenticate anywhere in the domain.
• Sibling: Silver Ticket. The smaller-scope version forges a service ticket directly with a service account’s hash, skipping the KDC for that one service instead of the whole domain.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

How to Detect It

• Flag TGTs with anomalous lifetimes — far longer than the domain’s configured maximum.
• Watch for Event 4769 service-ticket requests with no matching prior 4768 — a forged TGT never touched the KDC to begin with.
• Look for account names that don’t exist in Active Directory requesting access — a classic Golden Ticket tell.
• Check for encryption-type mismatches between the ticket and the domain’s configured Kerberos policy.

How to Defend Against It

• Protect krbtgt as tier-0. It should never be reachable by anything short of full DC compromise.
• Rotate krbtgt twice — on a regular schedule and immediately after any suspected DC compromise, since a single rotation leaves the old hash valid.
• Enforce least privilege to make the hash theft that precedes this attack harder in the first place.
• Monitor for ticket anomalies — lifetime, encryption type, and nonexistent accounts — as your last line of defense once the hash is already gone.

Log every forged-ticket indicator you find during testing, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.