HTB - Forest
TL;DR - A Windows domain controller that allows null-session enumeration over SMB/RPC, leaking the full list of domain users. One of them, svc-alfresco, has Kerberos pre-authentication disabled, so we AS-REP roast it, crack the hash to s3rvice, and log in over WinRM for user.txt. For root, BloodHound maps an ACL chain: svc-alfresco has GenericAll over the Exchange Windows Permissions group, that group holds WriteDACL over the domain object, so we add ourselves to the group, grant our user DCSync rights, dump the Administrator NT hash with secretsdump, and pass-the-hash in as Domain Admin. ...