I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets.

The command usually takes the form (Golden tickets):

kerberos::golden /sid:SID /domain:DOMAIN /rc4:RC4 /user:USER /id:ID /ptt

The command for Silver tickets takes the /rc4 parameter as well.

Can someone tell me what this parameter is for, and how to obtain the necessary information?

  • It's supposed to be the NTLM hash for the account. Acquiring this hash is the fundamental attack. – Steve Aug 24 '18 at 18:04
  • @Steve - Thank you for your comment. I have two questions: (1) What if you create a fake user (this is possible with Silver/Golden tickets)? (2) Why "NTLM" hash? The parameter says "RC4", which is a stream cipher (not an MD4 hash). – Shuzheng Aug 25 '18 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.