Extract Kerberos tickets and keys from LSA with Rubeus
Dumping tickets from LSA gives you TGTs to pass, and requesting them for kerberoastable SPNs yields hashes to crack offline.
Tag: kerberos
sAMAccountName spoofing (noPac) to impersonate a DC
Renaming a machine account to match a DC and requesting a ticket after reset yields a service ticket as domain admin.
Abuse unconstrained delegation with a coerced DC
A host with unconstrained delegation caches TGTs of everyone who authenticates; coerce a DC to it and steal the DC TGT.
AS-REP roast accounts without preauth
Accounts with Kerberos preauth disabled hand out an offline-crackable blob to any unauthenticated requester.
Targeted Kerberoasting by writing an SPN
With write access to a user object, set a fake SPN, roast the ticket offline, then remove the SPN.
Resource-based constrained delegation from a single GenericWrite
One writable computer object plus a controlled account lets you S4U your way to any user on that host.