Now in our challenge we set out to make sure that we could create a golden ticket and apply it and
make sure that we actually own the same sheet of music and make it sure that we can perform this
attack to maintain that persistence. So let's do it to it and inside of session four we're going
to be going into the load Kiwi if we haven't done it already. Since it's already loaded
there should be no problem and we should be able to go into dc-sync ntlm and then the krbtgt account
because and I was totally in meterpreter the entire time you just didn't see that part because
I skipped past it. But now that I've loaded Kiwi inside of meterpreter and I'm going to go through
and do my dc-sync ntlm for the actual krbtgt account we get the actual ntlm hash and at this
point you need to be able to create your golden ticket inside of your shell here our meterpreter
console here so it's golden ticket create and you're going to be using dash d to identify the
actual domain the dash u for the phantom user which is the point of this entirety of this exercise
dash s which I am missing again because that's what I like to do and then you're going to be
doing the sit now I've already kept this open here and that's where the uh I did this through
the impact look up sid for texas local I'll go ahead and paste that selection there and then our
dash k is the ntlm hash of the actual krbtgt user account user account and then dash t is where we're
going to be exporting the golden ticket to I'm going to name this one golden ticket two and put
it on the actual desktop itself and now we want to be able to go in and actually use that golden
ticket and this is as simple as saying Kerberos ticket use golden dot ticket two because that's
the one that I'm using on the actual desktop now once it's loaded yes you want to be able to type
in shell and verify who you are by saying who am I and yes we're as texas administrator but we should
still be able to go in and k list it and make sure that we are actually at waldo at texas local and
that's what you can actually see there that right there is the most reliable method for us to be
able to use the golden ticket to be able to access and maintain persistence in the sign of active
directory persistence that would be correct because everything in this particular skill
and really the previous one all leads up to actual persistence inside of active directory
now I want to stress this because there are going to be times where you're pin testing and you get
an avenue of approach blocked or taken away from you in some fashion but that's okay because the
skills that we have just learned in the previous skill and in this one tied together for us to be
able to create multiple back doors inside of that active directory environment that domain
environment for us to be able to create more than one method of return we don't just create one
account or one service or one dummy file for folks to be able to go in and give us access into the
organization if we are wanting to maintain a foothold in something and be able to come back
the next day and expect the same services to return to us we have to be able to create some
back doors and those back doors are what help us maintain that persistence within an organization
while we're within the scope of our actual pin test and also the rules of engagement because
some ROEs may not allow persistence be sure to read but it's very critical that you maintain
persistence inside of any kind of pin test as long as it's allowed so that way you can continue
to test and make sure there aren't any vulnerabilities that the organization doesn't
necessarily know about. I hope this has been informative for you and I'd like to thank you
for viewing.