Now this may seem a little bit too simple, but I want to show you something before we continue.
See, I'm still inside the same MetaPredator session, and I've already created the golden
ticket. I can very easily just go to Shell and say, Who am I? Now inside of the Shell,
you can see that I am Texas Administrator, and if I go a little bit deeper into the weeds,
I can actually go into K-List and see that I am currently logged in with zero cash tickets,
meaning that I am not logged in as anybody else other than Texas Administrator at this point.
So, where does it get weird? Well, I'm going to exit out of Shell for a second,
and I'm going to go through and basically apply the golden ticket that we've already created
for our targeted domain. We're going to be using Kerberos Ticket Use, and we're just simply going
to point to the actual golden ticket that we've already created on our actual desktop. I think I
have to type it out all the way. GoldenTicket.ticket, yes. And you can see that it has
been applied successfully. This is implied by here, where you get two status updates,
one using the actual ticket stored in golden ticket, and then the actual ticket that's applied.
I want you to take note right above this, where you see cash tickets as being zero.
The reason I bring this up is because now I'm going to go back into Shell and do another Who
Am I. You can see that I am still the Texas Administrator, which is glorious, but now I want
to do another basic K-List to go in and see that I am actually CBT at Texas Local. So, now I've
applied the golden ticket, and we've seen that we're able to change who it is that we're actually
on the actual system as, by taking this ticket that we've enumerated and created out of the
targeted domain, and issued it into the actual Active Directory login in a cash ticket, so that
way we can say that we are CBT at Texas.Local. Well, I want to show you there's nothing up my
sleeve, because let's go into the actual Active Directory here for a second, and this is AD
Users and Computers, and I'm just going to right click on texas.test, and just do a quick search
for CBT. Absolutely nothing came up, so this is a phantom account showing up in a phantom method
on a truly legitimate server, which now means that we have something weird going on,
and the fact that this is a ginormous flaw of being able to capture the ticket, and being able
to issue a golden ticket, if that. Now, does this mean that we have to be logged in as Administrator
to be able to issue this golden ticket? No, absolutely not. You can actually do this under
a regular user account, and have access to through Meterpreter to the actual domain
altogether. All we need is for the actual target to be the domain controller, not necessarily that
we need the DC to be, we don't need to be backdoored into DC once we actually have the
golden ticket. You can see that up to this point, there's a whole lot of, we need a lot of things
to work in order to be able to get this done, and while we were able to create the golden ticket
pretty quick, and with relative ease, along with the other Keros attacks that we've done already,
it may seem easy, but it is a whole lot more complex to do this out in the wild when you
have security controls, and especially all those hosted network-based IDS IPS systems out there.
Also, when you're monitoring, you have folks that are actually keeping an eye on
common attack methods. Now, a golden ticket attack is something that we'll dive more into
very shortly as the skill unfolds to see how we can use it, but I just want to point out also
that there are guides, books, notes, many different classes also spread out here on CBT Nuggets when
they go into the actual Microsoft certification courses that focus specifically on preventing
a golden ticket attack. So, if this is something, let's say you're pin testing and you're wanting
to do a little bit more, I'd highly recommend going in some of those pin testing, or not pin
testing labs, but the actual normal Microsoft labs and see if this is something you could do
to that test Active Directory controller inside of those labs. Now, you'll have to go in and load
Kali, so that might take a little bit, or load it in that live environment and get a little bit
more realistic in that way as well, but this is one of those things to where it can be extremely
dangerous inside of that Active Directory infrastructure. Back to our regularly scheduled
programming here inside of Metaprinter, and as you can see, I'm still at the actual C drive users
admin desktop DC share prompt, and I still have the actual ticket loaded, K list, yep, CBT at Texas
local. Now, what do we do with it from here? Well, this is where you get creative because you can
basically run any network administration, local administration, or domain administration tasks
that you want to run now. You are the domain admin. You are the enterprise admin of that domain.
You have the master key to go through and unlock all the doors if you want and expel all the
secrets. Now, I'm just going to show you here the inside of shell and Metaprinter. You can see that
net user tacos pad P at dollar dollar WRD slash add was successful, and it does it inside of the
actual domain itself. I'm going to go back inside of our DC here and look for tacos because, sorry,
I had to refresh. You can see it here right listed there as tacos. Now, that's the ability to create
and add a user, which we know requires at least delegated permissions inside of active directory
inside of our Kelly box. We can continue this even further by saying, you know,
add it to an actual group, and you can say net group domain admins
tacos slash add slash domain, and I totally spelled everything right first time, and as you can see,
the command did complete successfully, and there's a couple other things I want you to
notice here as well, too, because we ran this inside of shell inside of Metaprinter without
having to do a run as or get a prompt for elevated user permissions. So, this is where that golden
ticket application inside of Kali and MSF console can provide a dangerous combination for you to be
able to go through and do whatever it is that you want to do, and again, this isn't just because
we've been able to backdoor inside the DC with dummy two. Yes, that plays a large part in being
able to get information, exfiltration of data, of an enumeration of other data, but it's not
enumeration of other data from the actual domain overall, but it's the creation of that golden
ticket that allows us to be able to go through on the domain and truly do every and anything
that we want to do.