Hack.lu

TL;DR - A single forest with two domains in a parent-child trust (old.velocity.hacklu migrated into velocity.hacklu). A leftover svc_test (password = username) and a Kerberoasted svc_granite_sync:Granite00 give a foothold on the old DC. The parent has NTLM disabled, so I cross the within-forest trust with a Kerberos TGT, read the svc_backup_gmsa managed password, and use it to reach the Backup$ share holding an NTDS.dit export. secretsdump yields the old krbtgt, and a Golden Ticket forged with the AES key plus the parent’s Enterprise Admins SID in SID History (no SID filtering within a forest) escalates from Domain Admin on the child to Enterprise Admin across the entire forest. ...

TL;DR - Null-auth SMB on the member server exposes the WDS REMINST share, whose unattend XML leaks svc_deploy:D3pl0y!_AgileCorp (base64 with the classic trailing Password quirk). BloodHound shows svc_deploy has GenericWrite over the SRV-BASELINE GPO, so pyGPOAbuse drops an immediate scheduled task that gives SYSTEM / local admin on SRV. Looting SRV yields the SRV$ machine hash and an email revealing the DC pulls WSUS updates over HTTPS. I hijack the WSUS DNS record (insecure dynamic update) to point at SRV, mint a legitimate ADCS WebServer cert for the WSUS name, and stand up a rogue WSUS (pyWSUS + socat TLS + a Ligolo pivot) that serves a Microsoft-signed PsExec as a SYSTEM ‘update’ - landing local admin on the DC, then DCSync for full domain compromise." ...