HTB - Authority
TL;DR — Port 8443 runs PWM, a self-service password portal, and SMB allows anonymous/guest access. That guest read on the Development share exposes Ansible automation whose PWM role holds ansible-vault encrypted secrets. Cracking the vault (ansible2john + john) and decrypting it gives the PWM admin svc_pwm:pWm_@dm!N_!23. Inside PWM I point the LDAP profile at a rogue server (plain ldap://389) and Responder captures svc_ldap:lDaP_1n_th3_cle4r! in cleartext — a WinRM user (user.txt). Finally, ADCS (the CorpVPN / ESC1 template) plus an LDAP shell adding my user to Domain Admins lands Administrator and root.txt. ...