Diamond Ticket Attack: Abusing Kerberos Trust

“The attacker doesn’t need to steal the original TGT or create a completely new one; instead, they simply manipulate the PAC within an existing TGT and re-encrypt it to make it appear absolutely legitimate.”

A Golden Ticket is forged from nothing — a brand-new TGT that the KDC never issued. That is its weakness: a ticket with no corresponding AS-REQ, default ten-year lifetimes, group memberships that do not line up with the account, all of which a tuned detection can catch. The Diamond Ticket answers each of those tells by not forging a ticket at all. It asks the DC for a real one and edits it. Diamond Ticket Attack: Abusing Kerberos Trust pulls that surgery apart.

Decrypting the Kerberos Architecture

The book sets a heavy technical baseline first, diagramming a TGT and, crucially, the Privilege Attribute Certificate inside it. The PAC is where the user’s group memberships live, and therefore where their authorisation is decided. The point it builds to: services trust the PAC because it is signed with the KRBTGT key, so whoever holds that key can write a PAC that says anything and have it believed.

Forging the Diamond

The whole attack rests on one prerequisite — you must already have the KRBTGT AES key. Everything downstream follows:

1. Request: Ask the DC for a genuine TGT for an ordinary user. This one really was issued, with a real authentication behind it.
2. Decrypt: Use the stolen KRBTGT key to open the ticket.
3. Manipulate: Rewrite the PAC’s group memberships, adding Domain or Enterprise Admin.
4. Re-Encrypt: Seal it back up with the same KRBTGT key and use it via Pass-the-Ticket.

Worth stating plainly: this is post-exploitation. Needing the KRBTGT key means you already own the domain in the way that matters — the Diamond Ticket is about persistence and stealth, not the initial break. The trade against a Golden Ticket is effort for evasiveness: it is more work per ticket, but the result blends into legitimate authentication traffic in a way a forged ticket never does.

Multi-Platform Execution Paths

Walkthroughs on both sides of the house:

• Remote Execution (Linux): The Impacket syntax to request the legitimate ticket, rewrite the PAC, and push it over the network.
• Local Execution (Windows): Mimikatz to lift the KRBTGT hash and Rubeus to manipulate tickets in memory.

Who Is This Book REALLY For?

• Senior Red Teamers: When a Golden Ticket lights up the SIEM, the Diamond Ticket is the quieter pivot.
• Active Directory Architects: A reason to treat the KRBTGT account as the crown jewel it is — and to know that a single reset is not enough, since the key has two password histories.
• Threat Hunters & Blue Teams: The argument that watching for anomalous logons is not enough; the signals that matter are KRBTGT handling and ticket-lifetime oddities.

The Bottom Line

Diamond Ticket Attack: Abusing Kerberos Trust shows that finishing off a domain is rarely loud. It is a precise cryptographic edit that turns Kerberos’s own signature-based trust against the directory it was meant to protect.