> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/ad/persistence/kerberos/forged-tickets.md).

# Forged tickets

Silver and Golden tickets are forged Kerberos tickets that can be used with [pass-the-ticket](broken://pages/WzYZzG0ZhkKkcln8Wb4o) to access services in an Active Directory domain.

* When one of `krbtgt`'s Kerberos keys is known, a [golden ticket](/ad/movement/kerberos/forged-tickets.md#golden-ticket) attack can be conducted to keep privileged access until that account's password is changed.
* Let `service` be an account in charge of various services indicated in its `ServicePrincipalNames` attribute, when one of `service`'s Kerberos keys is known, a [silver ticket](/ad/movement/kerberos/forged-tickets.md#silver-ticket) attack can be conducted to keep privileged access to those managed services until that account's password is changed.

{% content-ref url="/pages/lnvUbyfbGqv49cUZ2CRU" %}
[Forged tickets](/ad/movement/kerberos/forged-tickets.md)
{% endcontent-ref %}