Gmsa

TL;DR - A single forest with two domains in a parent-child trust (old.velocity.hacklu migrated into velocity.hacklu). A leftover svc_test (password = username) and a Kerberoasted svc_granite_sync:Granite00 give a foothold on the old DC. The parent has NTLM disabled, so I cross the within-forest trust with a Kerberos TGT, read the svc_backup_gmsa managed password, and use it to reach the Backup$ share holding an NTDS.dit export. secretsdump yields the old krbtgt, and a Golden Ticket forged with the AES key plus the parent’s Enterprise Admins SID in SID History (no SID filtering within a forest) escalates from Domain Admin on the child to Enterprise Admin across the entire forest. ...

TL;DR - An assumed-breach Active Directory box. Starting from henry, I chain ACLs through BloodHound: a targeted Kerberoast on alfred, abusing AddSelf + ReadGMSAPassword to read the ansible_dev$ gMSA password, then a trail of ForceChangePassword and WriteOwner abuses to pivot sam → john and land a WinRM shell. For root, john controls an OU holding a deleted cert_admin account, so I restore it from the AD Recycle Bin, reset its password, and abuse an ESC15 (CVE-2024-49019) vulnerable certificate template to impersonate the Administrator. ...