A forged TGT (ticket-granting ticket) signed with the krbtgt account hash. With the krbtgt hash (e.g., via DCSync), an attacker mints arbitrary Kerberos tickets with any privileges, group membership and lifetime — near-invisible domain persistence.
The only reliable revocation is resetting the krbtgt password twice. Related: Silver Ticket (forging a TGS for one specific service).