Dns-Hijack

TL;DR - Null-auth SMB on the member server exposes the WDS REMINST share, whose unattend XML leaks svc_deploy:D3pl0y!_AgileCorp (base64 with the classic trailing Password quirk). BloodHound shows svc_deploy has GenericWrite over the SRV-BASELINE GPO, so pyGPOAbuse drops an immediate scheduled task that gives SYSTEM / local admin on SRV. Looting SRV yields the SRV$ machine hash and an email revealing the DC pulls WSUS updates over HTTPS. I hijack the WSUS DNS record (insecure dynamic update) to point at SRV, mint a legitimate ADCS WebServer cert for the WSUS name, and stand up a rogue WSUS (pyWSUS + socat TLS + a Ligolo pivot) that serves a Microsoft-signed PsExec as a SYSTEM ‘update’ - landing local admin on the DC, then DCSync for full domain compromise." ...