CISSP GLOSSARY · IDENTITY & ACCESS MANAGEMENT
Golden ticket attack
Forging Kerberos TGTs with the stolen KRBTGT password hash, giving an attacker any identity and any group membership in the domain, with a validity period the attacker chooses.
A golden ticket attack forges Ticket Granting Tickets using the stolen password hash of the KRBTGT account. Because that hash is the key every KDC uses to encrypt and validate TGTs, a forged ticket is cryptographically indistinguishable from a real one. The attacker can claim any identity, including accounts that do not exist, grant themselves Domain Admins membership, and set a ticket lifetime measured in years.
The attack requires domain-level compromise first, typically via a DCSync attack or dumping credentials from a domain controller. Once the KRBTGT hash is out, the attacker no longer needs the KDC’s cooperation, which is what makes detection so hard. The standard remediation is resetting the KRBTGT password twice, covered in detail in the golden ticket guide.
Exam relevance: golden ticket questions hinge on scope and persistence. Forged TGTs mean domain-wide access; contrast that with the silver ticket attack, which forges a service ticket for one service only. If a scenario mentions the KRBTGT hash or a double password reset, the answer is golden ticket.