How it went

1. 0
   nmap

   nmap shows an AD domain controller with NTLM disabled and an IIS SSO app.

2. 1
   LDAP injection

   A double-URL-encoded LDAP injection in the SSO login reads johnathan.j's description attribute, leaking the domain default password.

3. 2
   natalie.a

   The default password sprays to ken.w; a separate brute of the SSO's own password store lands natalie.a.

4. 3
   bob.w

   natalie.a's GenericWrite adds shadow credentials to bob.w for his NT hash.

5. 4
   OU move

   bob.w's WriteProperty on the Security OU moves auditor into the Web Department, bringing it under natalie.a's GenericWrite.

6. 5
   auditor

   natalie.a shadow-creds auditor and mints a TGT; auditor is in Remote Management Users, so WinRM lands a shell and the user flag.

7. 6
   ESC3

   auditor enables fernando.r, whose ESC3 enrollment-agent rights mint an on-behalf-of cert for ashley.b.

8. 7
   IIS_Admin

   ashley.b triggers an adminSDHolder cleanup task to re-enable inheritance on IIS_Administrator and shadow-cred it.

9. 8
   DCSync

   IIS_Administrator resets IIS_WEBSERVER$, and an RBCD U2U (Tiranid) attack impersonates Administrator to DCSync the domain.