mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-25 14:10:41 +00:00
68 lines
4.1 KiB
Markdown
68 lines
4.1 KiB
Markdown
|
# Diamond Ticket
|
||
|
|
|
||
|
|
<details>
|
||
|
|
|
||
|
|
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||
|
|
|
||
|
|
Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
|
|
|
||
|
|
Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
|
|
|
||
|
|
Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
|
|
|
||
|
|
**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||
|
|
|
||
|
|
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||
|
|
|
||
|
|
</details>
|
||
|
|
|
||
|
|
## Diamond Ticket
|
||
|
|
|
||
|
|
**Like a golden ticket**, a diamond ticket is a TGT which can be used to **access any service as any user**. A golden ticket is forged completely offline, encrypted with the krbtgt hash of that domain, and then passed into a logon session for use. Because domain controllers don't track TGTs it (or they) have legitimately issued, they will happily accept TGTs that are encrypted with its own krbtgt hash.
|
||
|
|
|
||
|
|
There are two common techniques to detect the use of golden tickets:
|
||
|
|
|
||
|
|
* Look for TGS-REQs that have no corresponding AS-REQ.
|
||
|
|
* Look for TGTs that have silly values, such as Mimikatz's default 10-year lifetime.
|
||
|
|
|
||
|
|
A **diamond ticket** is made by **modifying the fields of a legitimate TGT that was issued by a DC**. This is achieved by **requesting** a **TGT**, **decrypting** it with the domain's krbtgt hash, **modifying** the desired fields of the ticket, then **re-encrypting it**. This **overcomes the two aforementioned shortcomings** of a golden ticket because:
|
||
|
|
|
||
|
|
* TGS-REQs will have a preceding AS-REQ.
|
||
|
|
* The TGT was issued by a DC which means it will have all the correct details from the domain's Kerberos policy. Even though these can be accurately forged in a golden ticket, it's more complex and open to mistakes.
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# Get user RID
|
||
|
|
powershell Get-DomainUser -Identity <username> -Properties objectsid
|
||
|
|
|
||
|
|
.\Rubeus.exe diamond /tgtdeleg /ticketuser:<username> /ticketuserid:<RID of username> /groups:512
|
||
|
|
|
||
|
|
# /tgtdeleg uses the Kerberos GSS-API to obtain a useable TGT for the user without needing to know their password, NTLM/AES hash, or elevation on the host.
|
||
|
|
# /ticketuser is the username of the principal to impersonate.
|
||
|
|
# /ticketuserid is the domain RID of that principal.
|
||
|
|
# /groups are the desired group RIDs (512 being Domain Admins).
|
||
|
|
# /krbkey is the krbtgt AES256 hash.
|
||
|
|
```
|
||
|
|
|
||
|
|
\
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<details>
|
||
|
|
|
||
|
|
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||
|
|
|
||
|
|
Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
|
|
|
||
|
|
Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
|
|
|
||
|
|
Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
|
|
|
||
|
|
**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||
|
|
|
||
|
|
**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||
|
|
|
||
|
|
</details>
|