Overview of steps:
- Dump or have the Krbtgt’s NTLM hash
- have the pre-requisite values like domain sid, NTLM hash, username
- export ticket and use with wmiexec or psexec.
Follow this article https://medium.com/@ryanchamruiyang/proving-grounds-hutch-walkthrough-by-ryan-cham-907c027bbf20