Diamond tickets
Last updated
Was this helpful?
Last updated
Was this helpful?
and can usually be detected by probes that monitor the service ticket requests (KRB_TGS_REQ) that have no corresponding TGT requests (KRB_AS_REQ). Those types of tickets also feature forged PACs that sometimes fail at mimicking real ones, thus increasing their detection rates. Diamond tickets can be a useful alternative in the way they simply request a normal ticket, decrypt the PAC, modify it, recalculate the signatures and encrypt it again. It requires knowledge of the target service long-term key (can be the krbtgt for a TGT, or a target service for a Service Ticket).
Since Golden and Silver tickets are fully forged are not preceded by legitimate TGT (KRB_AS_REQ) or Service Ticket requests (KRB_TGS_REQ), detection rates are quite high. Diamond tickets are an alternative to obtaining similar tickets in a stealthier way.
In this scenario, an attacker that has knowledge of the service long-term key (krbtgt keys in case of a TGT, service account keys of Service Tickets) can request a legitimate ticket, decrypt the PAC, modify it, recalculate the signatures and encrypt the ticket again. This technique allows to produce a PAC that is highly similar to a legitimate one and also produces legitimate requests.
From UNIX-like systems, 's (Python) script can be used for such purposes.
In its actual form (as of September 9th, 2022), the script doesn't modify the PAC in the ticket obtained but instead fully replaces it with a full-forged one. This is not the most stealthy approach as the forged PAC could embed wrong information. Testers are advised to opt for the sapphire ticket approach. On top of that, if there are some structure in the PAC that Impacket can't handle, those structures will be missing in the newly forged PAC.
