• 👉 Overview
• 👀 What ?
• 🧐 Why ?
• ⛏️ How ?
• ⏳ When ?
• ⚙️ Technical Explanations
• 🖇️ References

👉 Overview

👀 What ?

Windows Silver Ticket is an attack technique used in cyber-security to exploit the service tickets in Microsoft's Kerberos implementation. It is a form of a pass-the-ticket attack, specifically targeting the Service Tickets issued by Kerberos Ticket Granting Service (TGS).

🧐 Why ?

Understanding Silver Ticket attacks is crucial for both Red Team and Blue Team professionals. For Red Team, it provides a stealthy method of gaining persistent access to network resources. For Blue Team, understanding this technique is key for developing effective detection strategies and securing the network against such threats.

⛏️ How ?

To execute a Silver Ticket attack, an attacker first needs to obtain the service account's NTLM hash. Once this is obtained, an attacker can forge a TGS for any service on the network that uses this service account for authentication. The forged TGS can then be used to access the targeted service as if they were a legitimate user.

⏳ When ?

Silver Ticket attacks have been a known threat in the cyber-security landscape since around 2014, when it was publicly discussed at the DEF CON conference.

⚙️ Technical Explanations

At a technical level, the Silver Ticket attack exploits the trust relationship between services and the Ticket Granting Service in Kerberos protocol. When a user requests access to a service, the TGS issues a service ticket which contains the user's identity, the service's identity, and a session key for communication. The service trusts that any ticket presented is legitimate, as it is supposed to be issued only by the TGS. However, if an attacker can obtain the service account's NTLM hash, they can forge this ticket. Since the service does not check the authenticity of the ticket with the TGS, it accepts the forged ticket as valid. This allows an attacker to impersonate any user and gain their access rights to the service.

🖇️ References