HTB - Administrator
TL;DR - An assumed-breach Active Directory box starting with Olivia:ichliebedich. BloodHound maps an ACL chain: Olivia has GenericAll over Michael, Michael can ForceChangePassword on Benjamin, and Benjamin (in Share Moderators) can reach an FTP backup. That backup is a Password Safe vault, cracked to reveal mid-chain users, one of whom (Emily) has GenericWrite over Ethan. A targeted Kerberoast against Ethan cracks his password, and Ethan holds DCSync rights, so secretsdump dumps every hash and a pass-the-hash as Administrator finishes the box. ...