https://leikah.haoyingcao.xyz/en/tags/silver-ticket/Recent content in Silver Ticket on LEIKAHHugoenhttps://leikah.haoyingcao.xyz/en/docs/active_directory/movement/kerberos/silver_ticket/Mon, 01 Jan 0001 00:00:00 +0000https://leikah.haoyingcao.xyz/en/docs/active_directory/movement/kerberos/silver_ticket/<h2 id="theory">Theory<a class="td-heading-self-link" href="#theory" aria-label="Heading self-link"></a></h2> <p><strong>Service Tickets (ST)</strong> are encrypted with a password-derived key of the service account associated with the <strong>service principal</strong>. If the password of the service account is known to the attacker, e.g. after a successful Kerberoasting, the attacker can derive the key from the password and craft their own service tickets to authenticate as <strong>any user</strong> to the compromised service principal.</p> <h2 id="linux-perspective">Linux Perspective<a class="td-heading-self-link" href="#linux-perspective" aria-label="Heading self-link"></a></h2> <p>We may use <code>ticketer.py</code> from the Impacket suite to craft a silver ticket as any valid domain user.</p>