S4u2self

SMB enumeration reveals ansible configuration files for a running webserver that is hosting an LDAPS Server. In those files, contains an ansible vault that has a crackable password revealing credentials to the LDAP Server and executing a Pass-Back Attack revealing more sensitive credentials that are used for initial foothold. Later enumerating ADCS reveals ESC1 for Computer Accounts group which led to creating a computer account and spawning an LDAP-shell and adding the low-privileged user to the Administrators group gaining DA access

Guest logon enumeration was used to discover an LDAP querying application that was reverse-engineered to find encrypted credentials that allowed for more enumeration that leads to LDAP eunumeration to discover more credentials for user access. Bloodhound shows an attack vector having access with an ACE of GenericAll over a computer account that leads to Resource-Based Constrained Delegation that grants SYSTEM access