Comprehensive walk-through of the Retro machine, demonstrating a transition from guest SMB access to Domain Admin. The process involves credential harvesting from public shares, exploiting pre-created computer accounts via Kerberos TGT requests, and leveraging misconfigured AD CS templates (ESC2/ESC3) for identity impersonation.
# tag: ESC2/ESC3
Retro