Re: Threat vector of running a service using a domain account

["Ali, Saqib" <docbook.xml () gmail com>]

> If you had the machine offline and patched it into a hub with another
> box running Wireshark or Ettercap (or other) and restarted the service,
> I wonder if you could crack the captured hash?  You'd at least have a DA
> account's hash for replay.

I don't think password hashes are floating around on the network in a
kerberos enabled Active Directory. Kerberos tickets are issued to the
servers.