How it went

1. 0
   nmap

   With assumed-breach pentest creds, LDAP enum maps delegation, gMSA accounts, and an IT group with Validated-SPN write.

2. 1
   Pre-Win2000

   MS01$ and EXCH01$ are Pre-Windows 2000 accounts whose password is just the lowercase computer name.

3. 2
   gMSA creds

   MS01$ sits in Domain Secure Servers and reads both gMSA passwords; gMSA_ADCS_prod$ gives a WinRM shell on DC01.

4. 3
   NTLM relay

   A chisel SOCKS pivot reaches WEB01; PetitPotam coerces it and the relayed NTLM sets RBCD, impersonating Administrator on WEB01.

5. 4
   a.white

   Dumping WEB01's LSA secrets recovers a.white's password; logging in as a.white grabs the user flag.

6. 5
   delegation

   a.white force-changes a.white_adm, whose constrained delegation re-grants Administrator on WEB01.

7. 6
   SPN hijack

   The IT group's Validated-SPN write moves HTTP/WEB01 onto DC01$, so S4U2Proxy issues a CIFS/DC01 ticket as Administrator, giving domain admin.